xmrig | 2cf03f4f06ea535623804a08de5cc6508e6073a9c86a74ad980409eb38a38e95

Analysis

max time kernel
71s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
29/04/2024, 05:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
Size

2.2MB
MD5

06e497d7247e398ed490a3d5b017a490
SHA1

6360d0a7a26957a2969da37f5525ef0fe0704fe7
SHA256

2cf03f4f06ea535623804a08de5cc6508e6073a9c86a74ad980409eb38a38e95
SHA512

c3a77e7608163221b22c06c2a7ee56789cd5d362a43366ff5e9593a7ea1f087748f4a011d5a46d858f4e67988b90e87a1ce3fb20f11548c7a6bfe72bbfd63942
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qr8+P22:NABi

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 43 IoCs

miner

resource	yara_rule
behavioral2/memory/2080-262-0x00007FF6EA300000-0x00007FF6EA6F2000-memory.dmp	xmrig
behavioral2/memory/4248-275-0x00007FF77D800000-0x00007FF77DBF2000-memory.dmp	xmrig
behavioral2/memory/5092-286-0x00007FF6AF770000-0x00007FF6AFB62000-memory.dmp	xmrig
behavioral2/memory/3252-291-0x00007FF60E380000-0x00007FF60E772000-memory.dmp	xmrig
behavioral2/memory/2128-290-0x00007FF634D30000-0x00007FF635122000-memory.dmp	xmrig
behavioral2/memory/2752-289-0x00007FF7AE2F0000-0x00007FF7AE6E2000-memory.dmp	xmrig
behavioral2/memory/3552-288-0x00007FF6088B0000-0x00007FF608CA2000-memory.dmp	xmrig
behavioral2/memory/5060-287-0x00007FF7C8850000-0x00007FF7C8C42000-memory.dmp	xmrig
behavioral2/memory/3740-283-0x00007FF62B860000-0x00007FF62BC52000-memory.dmp	xmrig
behavioral2/memory/4424-280-0x00007FF6C5880000-0x00007FF6C5C72000-memory.dmp	xmrig
behavioral2/memory/4960-279-0x00007FF7DCFA0000-0x00007FF7DD392000-memory.dmp	xmrig
behavioral2/memory/1412-261-0x00007FF7423F0000-0x00007FF7427E2000-memory.dmp	xmrig
behavioral2/memory/3592-250-0x00007FF64C920000-0x00007FF64CD12000-memory.dmp	xmrig
behavioral2/memory/1584-238-0x00007FF6254C0000-0x00007FF6258B2000-memory.dmp	xmrig
behavioral2/memory/4468-205-0x00007FF6FF7A0000-0x00007FF6FFB92000-memory.dmp	xmrig
behavioral2/memory/3488-196-0x00007FF6F2530000-0x00007FF6F2922000-memory.dmp	xmrig
behavioral2/memory/3568-195-0x00007FF764D80000-0x00007FF765172000-memory.dmp	xmrig
behavioral2/memory/3412-177-0x00007FF7F38E0000-0x00007FF7F3CD2000-memory.dmp	xmrig
behavioral2/memory/3804-127-0x00007FF747440000-0x00007FF747832000-memory.dmp	xmrig
behavioral2/memory/1056-98-0x00007FF64DFB0000-0x00007FF64E3A2000-memory.dmp	xmrig
behavioral2/memory/4460-22-0x00007FF71D2D0000-0x00007FF71D6C2000-memory.dmp	xmrig
behavioral2/memory/4872-1902-0x00007FF619D40000-0x00007FF61A132000-memory.dmp	xmrig
behavioral2/memory/4460-2032-0x00007FF71D2D0000-0x00007FF71D6C2000-memory.dmp	xmrig
behavioral2/memory/1056-2034-0x00007FF64DFB0000-0x00007FF64E3A2000-memory.dmp	xmrig
behavioral2/memory/3804-2036-0x00007FF747440000-0x00007FF747832000-memory.dmp	xmrig
behavioral2/memory/3592-2044-0x00007FF64C920000-0x00007FF64CD12000-memory.dmp	xmrig
behavioral2/memory/2128-2042-0x00007FF634D30000-0x00007FF635122000-memory.dmp	xmrig
behavioral2/memory/2080-2046-0x00007FF6EA300000-0x00007FF6EA6F2000-memory.dmp	xmrig
behavioral2/memory/3252-2040-0x00007FF60E380000-0x00007FF60E772000-memory.dmp	xmrig
behavioral2/memory/3412-2039-0x00007FF7F38E0000-0x00007FF7F3CD2000-memory.dmp	xmrig
behavioral2/memory/4960-2072-0x00007FF7DCFA0000-0x00007FF7DD392000-memory.dmp	xmrig
behavioral2/memory/2752-2073-0x00007FF7AE2F0000-0x00007FF7AE6E2000-memory.dmp	xmrig
behavioral2/memory/1412-2076-0x00007FF7423F0000-0x00007FF7427E2000-memory.dmp	xmrig
behavioral2/memory/4424-2070-0x00007FF6C5880000-0x00007FF6C5C72000-memory.dmp	xmrig
behavioral2/memory/3740-2068-0x00007FF62B860000-0x00007FF62BC52000-memory.dmp	xmrig
behavioral2/memory/4468-2066-0x00007FF6FF7A0000-0x00007FF6FFB92000-memory.dmp	xmrig
behavioral2/memory/5092-2064-0x00007FF6AF770000-0x00007FF6AFB62000-memory.dmp	xmrig
behavioral2/memory/5060-2062-0x00007FF7C8850000-0x00007FF7C8C42000-memory.dmp	xmrig
behavioral2/memory/3552-2060-0x00007FF6088B0000-0x00007FF608CA2000-memory.dmp	xmrig
behavioral2/memory/1584-2055-0x00007FF6254C0000-0x00007FF6258B2000-memory.dmp	xmrig
behavioral2/memory/3568-2052-0x00007FF764D80000-0x00007FF765172000-memory.dmp	xmrig
behavioral2/memory/3488-2049-0x00007FF6F2530000-0x00007FF6F2922000-memory.dmp	xmrig
behavioral2/memory/4248-2058-0x00007FF77D800000-0x00007FF77DBF2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4460	wZQFlVI.exe
2128	rNSFZcz.exe
1056	WMMDXQJ.exe
3804	wpRWDfu.exe
3412	bCyzMgm.exe
3252	WtZyiez.exe
3568	gTsEipQ.exe
3488	XKxTeJZ.exe
4468	oHxzUuM.exe
1584	xTzSVkf.exe
3592	hqBtSug.exe
1412	ceyiJle.exe
2080	qEYLgfe.exe
4248	tzxuCca.exe
4960	BuVeEBk.exe
4424	NtaupkE.exe
3740	qnaTITV.exe
5092	bMbvRZz.exe
5060	rgNEllb.exe
3552	hrxulFf.exe
2752	Exxcllw.exe
5000	eneuXwN.exe
3184	OSXBand.exe
4772	UsqzYeK.exe
1732	jVHocZK.exe
1288	JUgJgzn.exe
4768	YyGXEwn.exe
3436	qAXvgmv.exe
956	NuQabKw.exe
1096	enLRyFl.exe
1468	PNdrLDi.exe
3156	fzzmBlV.exe
764	sCslkGV.exe
1432	zFDvAgl.exe
1944	HwNODZK.exe
4048	SgwalDy.exe
3172	ouFQIJg.exe
3816	ntRdbfZ.exe
2936	rNazoEZ.exe
3428	SOwYPSy.exe
1920	QZFrsZT.exe
2192	WixnLWL.exe
4260	SsMIFek.exe
2460	Zwmrqul.exe
3948	JjIEoGl.exe
4352	dwseCIY.exe
4300	CmlbFNE.exe
4332	sERgpAQ.exe
4928	MFmOvhi.exe
3124	fOnmUqp.exe
4868	AfnFIWR.exe
4068	nwGKArn.exe
4164	hdXfVRt.exe
4476	VnarbuS.exe
4008	gzOydCC.exe
1880	uhchNge.exe
3044	HcizFZQ.exe
3392	YMJnJTo.exe
916	imPIepk.exe
4992	EgSEsCL.exe
4056	sDHJtfe.exe
832	FnHSKpA.exe
1888	HJpfsUv.exe
2144	BpMqdgf.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4872-0-0x00007FF619D40000-0x00007FF61A132000-memory.dmp	upx
behavioral2/files/0x000c000000023b7a-8.dat	upx
behavioral2/files/0x000a000000023b92-20.dat	upx
behavioral2/files/0x000a000000023b91-25.dat	upx
behavioral2/files/0x000a000000023b96-34.dat	upx
behavioral2/files/0x000a000000023b95-71.dat	upx
behavioral2/files/0x000a000000023ba1-157.dat	upx
behavioral2/files/0x000a000000023ba3-168.dat	upx
behavioral2/memory/2080-262-0x00007FF6EA300000-0x00007FF6EA6F2000-memory.dmp	upx
behavioral2/memory/4248-275-0x00007FF77D800000-0x00007FF77DBF2000-memory.dmp	upx
behavioral2/memory/5092-286-0x00007FF6AF770000-0x00007FF6AFB62000-memory.dmp	upx
behavioral2/memory/3252-291-0x00007FF60E380000-0x00007FF60E772000-memory.dmp	upx
behavioral2/memory/2128-290-0x00007FF634D30000-0x00007FF635122000-memory.dmp	upx
behavioral2/memory/2752-289-0x00007FF7AE2F0000-0x00007FF7AE6E2000-memory.dmp	upx
behavioral2/memory/3552-288-0x00007FF6088B0000-0x00007FF608CA2000-memory.dmp	upx
behavioral2/memory/5060-287-0x00007FF7C8850000-0x00007FF7C8C42000-memory.dmp	upx
behavioral2/memory/3740-283-0x00007FF62B860000-0x00007FF62BC52000-memory.dmp	upx
behavioral2/memory/4424-280-0x00007FF6C5880000-0x00007FF6C5C72000-memory.dmp	upx
behavioral2/memory/4960-279-0x00007FF7DCFA0000-0x00007FF7DD392000-memory.dmp	upx
behavioral2/memory/1412-261-0x00007FF7423F0000-0x00007FF7427E2000-memory.dmp	upx
behavioral2/memory/3592-250-0x00007FF64C920000-0x00007FF64CD12000-memory.dmp	upx
behavioral2/memory/1584-238-0x00007FF6254C0000-0x00007FF6258B2000-memory.dmp	upx
behavioral2/memory/4468-205-0x00007FF6FF7A0000-0x00007FF6FFB92000-memory.dmp	upx
behavioral2/memory/3488-196-0x00007FF6F2530000-0x00007FF6F2922000-memory.dmp	upx
behavioral2/memory/3568-195-0x00007FF764D80000-0x00007FF765172000-memory.dmp	upx
behavioral2/files/0x000a000000023ba7-191.dat	upx
behavioral2/files/0x000a000000023bae-189.dat	upx
behavioral2/files/0x000a000000023bb5-188.dat	upx
behavioral2/files/0x000a000000023bb4-187.dat	upx
behavioral2/files/0x000a000000023bb3-186.dat	upx
behavioral2/files/0x000a000000023bb2-185.dat	upx
behavioral2/files/0x000a000000023bb1-184.dat	upx
behavioral2/files/0x000a000000023bb0-183.dat	upx
behavioral2/files/0x000a000000023baf-182.dat	upx
behavioral2/files/0x000a000000023ba8-178.dat	upx
behavioral2/memory/3412-177-0x00007FF7F38E0000-0x00007FF7F3CD2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba2-164.dat	upx
behavioral2/files/0x000a000000023ba0-158.dat	upx
behavioral2/files/0x000a000000023b9f-149.dat	upx
behavioral2/files/0x000a000000023b9e-142.dat	upx
behavioral2/files/0x000a000000023bab-139.dat	upx
behavioral2/files/0x000a000000023baa-135.dat	upx
behavioral2/files/0x000a000000023b9d-133.dat	upx
behavioral2/files/0x000a000000023ba4-128.dat	upx
behavioral2/memory/3804-127-0x00007FF747440000-0x00007FF747832000-memory.dmp	upx
behavioral2/files/0x000a000000023b97-123.dat	upx
behavioral2/files/0x000a000000023b9a-121.dat	upx
behavioral2/files/0x000a000000023ba6-111.dat	upx
behavioral2/files/0x000a000000023ba9-131.dat	upx
behavioral2/files/0x000a000000023ba5-103.dat	upx
behavioral2/files/0x000a000000023b98-102.dat	upx
behavioral2/memory/1056-98-0x00007FF64DFB0000-0x00007FF64E3A2000-memory.dmp	upx
behavioral2/files/0x000a000000023b9c-82.dat	upx
behavioral2/files/0x000a000000023b9b-63.dat	upx
behavioral2/files/0x000a000000023b99-55.dat	upx
behavioral2/files/0x000a000000023b94-51.dat	upx
behavioral2/files/0x000a000000023b93-45.dat	upx
behavioral2/files/0x000a000000023b90-29.dat	upx
behavioral2/memory/4460-22-0x00007FF71D2D0000-0x00007FF71D6C2000-memory.dmp	upx
behavioral2/memory/4872-1902-0x00007FF619D40000-0x00007FF61A132000-memory.dmp	upx
behavioral2/memory/4460-2032-0x00007FF71D2D0000-0x00007FF71D6C2000-memory.dmp	upx
behavioral2/memory/1056-2034-0x00007FF64DFB0000-0x00007FF64E3A2000-memory.dmp	upx
behavioral2/memory/3804-2036-0x00007FF747440000-0x00007FF747832000-memory.dmp	upx
behavioral2/memory/3592-2044-0x00007FF64C920000-0x00007FF64CD12000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\niqOycX.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\ByZKhqU.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\wxBKhXY.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\rNSFZcz.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\WixnLWL.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\aXuhDVB.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\kmkoxaw.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\WbQfqOp.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\tXANBTp.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\tddBbxZ.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\oHxzUuM.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\WfmDUcB.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\ilsXCEj.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\JRrQjga.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\KsRqtYG.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\ECwGVdB.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\sDHJtfe.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\xAdsXLn.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\dJjmWRX.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\ceyiJle.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\DnomfnZ.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\GwCteZc.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\xBYqVRQ.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\SsMIFek.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\futSyIV.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\lsHqCZl.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\ipPcHyu.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\zHOQQai.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\rZnwObx.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\dwseCIY.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\bSoBcuP.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\HpIbbYg.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\NpIuJOQ.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\ABMtVCa.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\rNazoEZ.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\MhXyNSS.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\SqvgDhJ.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\xSgpwCc.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\DIbRTtb.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\wKXlaCS.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\hbYfepa.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\FRocchc.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\LhMoAZt.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\cUEGCef.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\jDdqDVk.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\TcGlxzD.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\UsqzYeK.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\kXzKoZb.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\eQdRjMd.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\bVnhteo.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\yUFVWcD.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\AGyFmzh.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\bgNQmqC.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\GGsgJcW.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\WAKVwnL.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\ppVuGpe.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\xRvCPPa.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\VnarbuS.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\mcxiMir.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\nLdPrAZ.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\aqKmFsI.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\vtSvyuy.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\mNDtIwx.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
File created	C:\Windows\System\elEVrBX.exe	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2820	powershell.exe
2820	powershell.exe
2820	powershell.exe
2820	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
Token: SeDebugPrivilege	2820	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 2820	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	86
PID 4872 wrote to memory of 2820	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	86
PID 4872 wrote to memory of 4460	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	87
PID 4872 wrote to memory of 4460	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	87
PID 4872 wrote to memory of 2128	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	88
PID 4872 wrote to memory of 2128	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	88
PID 4872 wrote to memory of 1056	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	89
PID 4872 wrote to memory of 1056	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	89
PID 4872 wrote to memory of 3804	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	90
PID 4872 wrote to memory of 3804	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	90
PID 4872 wrote to memory of 3412	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	91
PID 4872 wrote to memory of 3412	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	91
PID 4872 wrote to memory of 3252	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	92
PID 4872 wrote to memory of 3252	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	92
PID 4872 wrote to memory of 3568	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	93
PID 4872 wrote to memory of 3568	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	93
PID 4872 wrote to memory of 3488	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	94
PID 4872 wrote to memory of 3488	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	94
PID 4872 wrote to memory of 4468	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	95
PID 4872 wrote to memory of 4468	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	95
PID 4872 wrote to memory of 1584	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	96
PID 4872 wrote to memory of 1584	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	96
PID 4872 wrote to memory of 3592	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	97
PID 4872 wrote to memory of 3592	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	97
PID 4872 wrote to memory of 1412	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	98
PID 4872 wrote to memory of 1412	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	98
PID 4872 wrote to memory of 2080	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	99
PID 4872 wrote to memory of 2080	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	99
PID 4872 wrote to memory of 4248	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	100
PID 4872 wrote to memory of 4248	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	100
PID 4872 wrote to memory of 4960	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	101
PID 4872 wrote to memory of 4960	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	101
PID 4872 wrote to memory of 4424	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	102
PID 4872 wrote to memory of 4424	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	102
PID 4872 wrote to memory of 3740	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	103
PID 4872 wrote to memory of 3740	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	103
PID 4872 wrote to memory of 5092	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	104
PID 4872 wrote to memory of 5092	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	104
PID 4872 wrote to memory of 5060	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	105
PID 4872 wrote to memory of 5060	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	105
PID 4872 wrote to memory of 3552	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	106
PID 4872 wrote to memory of 3552	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	106
PID 4872 wrote to memory of 2752	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	107
PID 4872 wrote to memory of 2752	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	107
PID 4872 wrote to memory of 5000	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	108
PID 4872 wrote to memory of 5000	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	108
PID 4872 wrote to memory of 3184	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	109
PID 4872 wrote to memory of 3184	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	109
PID 4872 wrote to memory of 4772	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	110
PID 4872 wrote to memory of 4772	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	110
PID 4872 wrote to memory of 1732	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	111
PID 4872 wrote to memory of 1732	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	111
PID 4872 wrote to memory of 1288	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	112
PID 4872 wrote to memory of 1288	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	112
PID 4872 wrote to memory of 4768	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	113
PID 4872 wrote to memory of 4768	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	113
PID 4872 wrote to memory of 3436	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	114
PID 4872 wrote to memory of 3436	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	114
PID 4872 wrote to memory of 956	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	115
PID 4872 wrote to memory of 956	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	115
PID 4872 wrote to memory of 1096	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	116
PID 4872 wrote to memory of 1096	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	116
PID 4872 wrote to memory of 1468	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	117
PID 4872 wrote to memory of 1468	4872	06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe	117

C:\Users\Admin\AppData\Local\Temp\06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\06e497d7247e398ed490a3d5b017a490_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2820
- C:\Windows\System\wZQFlVI.exe
  C:\Windows\System\wZQFlVI.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\rNSFZcz.exe
  C:\Windows\System\rNSFZcz.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\WMMDXQJ.exe
  C:\Windows\System\WMMDXQJ.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\wpRWDfu.exe
  C:\Windows\System\wpRWDfu.exe
  2⤵
  - Executes dropped EXE
  PID:3804
- C:\Windows\System\bCyzMgm.exe
  C:\Windows\System\bCyzMgm.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\WtZyiez.exe
  C:\Windows\System\WtZyiez.exe
  2⤵
  - Executes dropped EXE
  PID:3252
- C:\Windows\System\gTsEipQ.exe
  C:\Windows\System\gTsEipQ.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\XKxTeJZ.exe
  C:\Windows\System\XKxTeJZ.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\oHxzUuM.exe
  C:\Windows\System\oHxzUuM.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\xTzSVkf.exe
  C:\Windows\System\xTzSVkf.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\hqBtSug.exe
  C:\Windows\System\hqBtSug.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\ceyiJle.exe
  C:\Windows\System\ceyiJle.exe
  2⤵
  - Executes dropped EXE
  PID:1412
- C:\Windows\System\qEYLgfe.exe
  C:\Windows\System\qEYLgfe.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\tzxuCca.exe
  C:\Windows\System\tzxuCca.exe
  2⤵
  - Executes dropped EXE
  PID:4248
- C:\Windows\System\BuVeEBk.exe
  C:\Windows\System\BuVeEBk.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\NtaupkE.exe
  C:\Windows\System\NtaupkE.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\qnaTITV.exe
  C:\Windows\System\qnaTITV.exe
  2⤵
  - Executes dropped EXE
  PID:3740
- C:\Windows\System\bMbvRZz.exe
  C:\Windows\System\bMbvRZz.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\rgNEllb.exe
  C:\Windows\System\rgNEllb.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\hrxulFf.exe
  C:\Windows\System\hrxulFf.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\Exxcllw.exe
  C:\Windows\System\Exxcllw.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\eneuXwN.exe
  C:\Windows\System\eneuXwN.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\OSXBand.exe
  C:\Windows\System\OSXBand.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System\UsqzYeK.exe
  C:\Windows\System\UsqzYeK.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\jVHocZK.exe
  C:\Windows\System\jVHocZK.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\JUgJgzn.exe
  C:\Windows\System\JUgJgzn.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\YyGXEwn.exe
  C:\Windows\System\YyGXEwn.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\qAXvgmv.exe
  C:\Windows\System\qAXvgmv.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System\NuQabKw.exe
  C:\Windows\System\NuQabKw.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\enLRyFl.exe
  C:\Windows\System\enLRyFl.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\PNdrLDi.exe
  C:\Windows\System\PNdrLDi.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\fzzmBlV.exe
  C:\Windows\System\fzzmBlV.exe
  2⤵
  - Executes dropped EXE
  PID:3156
- C:\Windows\System\sCslkGV.exe
  C:\Windows\System\sCslkGV.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\zFDvAgl.exe
  C:\Windows\System\zFDvAgl.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\HwNODZK.exe
  C:\Windows\System\HwNODZK.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\SgwalDy.exe
  C:\Windows\System\SgwalDy.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\ouFQIJg.exe
  C:\Windows\System\ouFQIJg.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\ntRdbfZ.exe
  C:\Windows\System\ntRdbfZ.exe
  2⤵
  - Executes dropped EXE
  PID:3816
- C:\Windows\System\rNazoEZ.exe
  C:\Windows\System\rNazoEZ.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\SOwYPSy.exe
  C:\Windows\System\SOwYPSy.exe
  2⤵
  - Executes dropped EXE
  PID:3428
- C:\Windows\System\QZFrsZT.exe
  C:\Windows\System\QZFrsZT.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\WixnLWL.exe
  C:\Windows\System\WixnLWL.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\SsMIFek.exe
  C:\Windows\System\SsMIFek.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\Zwmrqul.exe
  C:\Windows\System\Zwmrqul.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\JjIEoGl.exe
  C:\Windows\System\JjIEoGl.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System\dwseCIY.exe
  C:\Windows\System\dwseCIY.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\CmlbFNE.exe
  C:\Windows\System\CmlbFNE.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\sERgpAQ.exe
  C:\Windows\System\sERgpAQ.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\MFmOvhi.exe
  C:\Windows\System\MFmOvhi.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\fOnmUqp.exe
  C:\Windows\System\fOnmUqp.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\AfnFIWR.exe
  C:\Windows\System\AfnFIWR.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\nwGKArn.exe
  C:\Windows\System\nwGKArn.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\hdXfVRt.exe
  C:\Windows\System\hdXfVRt.exe
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\System\VnarbuS.exe
  C:\Windows\System\VnarbuS.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\gzOydCC.exe
  C:\Windows\System\gzOydCC.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\uhchNge.exe
  C:\Windows\System\uhchNge.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\HcizFZQ.exe
  C:\Windows\System\HcizFZQ.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\YMJnJTo.exe
  C:\Windows\System\YMJnJTo.exe
  2⤵
  - Executes dropped EXE
  PID:3392
- C:\Windows\System\imPIepk.exe
  C:\Windows\System\imPIepk.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\EgSEsCL.exe
  C:\Windows\System\EgSEsCL.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\sDHJtfe.exe
  C:\Windows\System\sDHJtfe.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\FnHSKpA.exe
  C:\Windows\System\FnHSKpA.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\HJpfsUv.exe
  C:\Windows\System\HJpfsUv.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\BpMqdgf.exe
  C:\Windows\System\BpMqdgf.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\dDiIeHb.exe
  C:\Windows\System\dDiIeHb.exe
  2⤵
  PID:3328
- C:\Windows\System\npPTacG.exe
  C:\Windows\System\npPTacG.exe
  2⤵
  PID:5360
- C:\Windows\System\wtWLGXC.exe
  C:\Windows\System\wtWLGXC.exe
  2⤵
  PID:5376
- C:\Windows\System\yLBQrTe.exe
  C:\Windows\System\yLBQrTe.exe
  2⤵
  PID:5400
- C:\Windows\System\BWaCKJE.exe
  C:\Windows\System\BWaCKJE.exe
  2⤵
  PID:5420
- C:\Windows\System\BfDiLni.exe
  C:\Windows\System\BfDiLni.exe
  2⤵
  PID:5444
- C:\Windows\System\bgNQmqC.exe
  C:\Windows\System\bgNQmqC.exe
  2⤵
  PID:5468
- C:\Windows\System\OxlhMtb.exe
  C:\Windows\System\OxlhMtb.exe
  2⤵
  PID:5492
- C:\Windows\System\yDIewhg.exe
  C:\Windows\System\yDIewhg.exe
  2⤵
  PID:5524
- C:\Windows\System\QhELxuu.exe
  C:\Windows\System\QhELxuu.exe
  2⤵
  PID:5556
- C:\Windows\System\tFfahFG.exe
  C:\Windows\System\tFfahFG.exe
  2⤵
  PID:5576
- C:\Windows\System\vVaODPe.exe
  C:\Windows\System\vVaODPe.exe
  2⤵
  PID:5600
- C:\Windows\System\wyrRbyi.exe
  C:\Windows\System\wyrRbyi.exe
  2⤵
  PID:5628
- C:\Windows\System\HhPOIdQ.exe
  C:\Windows\System\HhPOIdQ.exe
  2⤵
  PID:5648
- C:\Windows\System\vrFIRSP.exe
  C:\Windows\System\vrFIRSP.exe
  2⤵
  PID:5672
- C:\Windows\System\HkcaABM.exe
  C:\Windows\System\HkcaABM.exe
  2⤵
  PID:5704
- C:\Windows\System\tVadXeF.exe
  C:\Windows\System\tVadXeF.exe
  2⤵
  PID:5728
- C:\Windows\System\Mulahui.exe
  C:\Windows\System\Mulahui.exe
  2⤵
  PID:5748
- C:\Windows\System\gwXbrID.exe
  C:\Windows\System\gwXbrID.exe
  2⤵
  PID:5776
- C:\Windows\System\kiaaksu.exe
  C:\Windows\System\kiaaksu.exe
  2⤵
  PID:5796
- C:\Windows\System\WZNOlWt.exe
  C:\Windows\System\WZNOlWt.exe
  2⤵
  PID:5824
- C:\Windows\System\rVGthdJ.exe
  C:\Windows\System\rVGthdJ.exe
  2⤵
  PID:5844
- C:\Windows\System\BQUudqt.exe
  C:\Windows\System\BQUudqt.exe
  2⤵
  PID:5864
- C:\Windows\System\LHrBlrM.exe
  C:\Windows\System\LHrBlrM.exe
  2⤵
  PID:5908
- C:\Windows\System\JyywyhA.exe
  C:\Windows\System\JyywyhA.exe
  2⤵
  PID:5924
- C:\Windows\System\uEQXQLG.exe
  C:\Windows\System\uEQXQLG.exe
  2⤵
  PID:5952
- C:\Windows\System\aXuhDVB.exe
  C:\Windows\System\aXuhDVB.exe
  2⤵
  PID:5972
- C:\Windows\System\FRjMkvx.exe
  C:\Windows\System\FRjMkvx.exe
  2⤵
  PID:5996
- C:\Windows\System\FZYdHuk.exe
  C:\Windows\System\FZYdHuk.exe
  2⤵
  PID:6016
- C:\Windows\System\AeBFeQa.exe
  C:\Windows\System\AeBFeQa.exe
  2⤵
  PID:6036
- C:\Windows\System\oNYpVlH.exe
  C:\Windows\System\oNYpVlH.exe
  2⤵
  PID:6060
- C:\Windows\System\xKRJijf.exe
  C:\Windows\System\xKRJijf.exe
  2⤵
  PID:6088
- C:\Windows\System\wnFRRQR.exe
  C:\Windows\System\wnFRRQR.exe
  2⤵
  PID:6132
- C:\Windows\System\XqAHaRa.exe
  C:\Windows\System\XqAHaRa.exe
  2⤵
  PID:2076
- C:\Windows\System\ZBcAome.exe
  C:\Windows\System\ZBcAome.exe
  2⤵
  PID:2340
- C:\Windows\System\EIcCuPL.exe
  C:\Windows\System\EIcCuPL.exe
  2⤵
  PID:4132
- C:\Windows\System\AorvNVK.exe
  C:\Windows\System\AorvNVK.exe
  2⤵
  PID:516
- C:\Windows\System\ItzGzbE.exe
  C:\Windows\System\ItzGzbE.exe
  2⤵
  PID:2856
- C:\Windows\System\DnomfnZ.exe
  C:\Windows\System\DnomfnZ.exe
  2⤵
  PID:60
- C:\Windows\System\oRAQCnG.exe
  C:\Windows\System\oRAQCnG.exe
  2⤵
  PID:3216
- C:\Windows\System\HJxhyae.exe
  C:\Windows\System\HJxhyae.exe
  2⤵
  PID:3908
- C:\Windows\System\auxoXHF.exe
  C:\Windows\System\auxoXHF.exe
  2⤵
  PID:456
- C:\Windows\System\oRVpXnV.exe
  C:\Windows\System\oRVpXnV.exe
  2⤵
  PID:5176
- C:\Windows\System\RRADHrP.exe
  C:\Windows\System\RRADHrP.exe
  2⤵
  PID:2628
- C:\Windows\System\MhXyNSS.exe
  C:\Windows\System\MhXyNSS.exe
  2⤵
  PID:5116
- C:\Windows\System\YuwFWvV.exe
  C:\Windows\System\YuwFWvV.exe
  2⤵
  PID:64
- C:\Windows\System\LxEyKNV.exe
  C:\Windows\System\LxEyKNV.exe
  2⤵
  PID:3152
- C:\Windows\System\QlFkyov.exe
  C:\Windows\System\QlFkyov.exe
  2⤵
  PID:876
- C:\Windows\System\TzeBNAz.exe
  C:\Windows\System\TzeBNAz.exe
  2⤵
  PID:4116
- C:\Windows\System\ILiHBYJ.exe
  C:\Windows\System\ILiHBYJ.exe
  2⤵
  PID:2064
- C:\Windows\System\JeNiidu.exe
  C:\Windows\System\JeNiidu.exe
  2⤵
  PID:4456
- C:\Windows\System\RKqzjqf.exe
  C:\Windows\System\RKqzjqf.exe
  2⤵
  PID:1948
- C:\Windows\System\dLBaBtJ.exe
  C:\Windows\System\dLBaBtJ.exe
  2⤵
  PID:4576
- C:\Windows\System\BEeAQDW.exe
  C:\Windows\System\BEeAQDW.exe
  2⤵
  PID:2688
- C:\Windows\System\wyIOiro.exe
  C:\Windows\System\wyIOiro.exe
  2⤵
  PID:3756
- C:\Windows\System\FVONLHK.exe
  C:\Windows\System\FVONLHK.exe
  2⤵
  PID:2988
- C:\Windows\System\aqKmFsI.exe
  C:\Windows\System\aqKmFsI.exe
  2⤵
  PID:2432
- C:\Windows\System\CKbppCX.exe
  C:\Windows\System\CKbppCX.exe
  2⤵
  PID:4276
- C:\Windows\System\yFCWItJ.exe
  C:\Windows\System\yFCWItJ.exe
  2⤵
  PID:5260
- C:\Windows\System\EKbASoY.exe
  C:\Windows\System\EKbASoY.exe
  2⤵
  PID:5288
- C:\Windows\System\MKvvBYL.exe
  C:\Windows\System\MKvvBYL.exe
  2⤵
  PID:2264
- C:\Windows\System\kXzKoZb.exe
  C:\Windows\System\kXzKoZb.exe
  2⤵
  PID:3864
- C:\Windows\System\jxkjmRQ.exe
  C:\Windows\System\jxkjmRQ.exe
  2⤵
  PID:5416
- C:\Windows\System\xOxixAB.exe
  C:\Windows\System\xOxixAB.exe
  2⤵
  PID:5480
- C:\Windows\System\BjKtkNX.exe
  C:\Windows\System\BjKtkNX.exe
  2⤵
  PID:5540
- C:\Windows\System\baaCAux.exe
  C:\Windows\System\baaCAux.exe
  2⤵
  PID:5572
- C:\Windows\System\OBuYsxf.exe
  C:\Windows\System\OBuYsxf.exe
  2⤵
  PID:5668
- C:\Windows\System\bSoBcuP.exe
  C:\Windows\System\bSoBcuP.exe
  2⤵
  PID:4808
- C:\Windows\System\zGTHegN.exe
  C:\Windows\System\zGTHegN.exe
  2⤵
  PID:5756
- C:\Windows\System\FTMgTrK.exe
  C:\Windows\System\FTMgTrK.exe
  2⤵
  PID:5836
- C:\Windows\System\QrxHTvM.exe
  C:\Windows\System\QrxHTvM.exe
  2⤵
  PID:5788
- C:\Windows\System\QfeYEHR.exe
  C:\Windows\System\QfeYEHR.exe
  2⤵
  PID:5832
- C:\Windows\System\PDdcIrx.exe
  C:\Windows\System\PDdcIrx.exe
  2⤵
  PID:6080
- C:\Windows\System\GXbZTlE.exe
  C:\Windows\System\GXbZTlE.exe
  2⤵
  PID:6044
- C:\Windows\System\RAmnWty.exe
  C:\Windows\System\RAmnWty.exe
  2⤵
  PID:6008
- C:\Windows\System\grCVtRv.exe
  C:\Windows\System\grCVtRv.exe
  2⤵
  PID:6140
- C:\Windows\System\DATtBaK.exe
  C:\Windows\System\DATtBaK.exe
  2⤵
  PID:6072
- C:\Windows\System\IEgkOJf.exe
  C:\Windows\System\IEgkOJf.exe
  2⤵
  PID:1160
- C:\Windows\System\DQwZmWg.exe
  C:\Windows\System\DQwZmWg.exe
  2⤵
  PID:1824
- C:\Windows\System\SDbnRUb.exe
  C:\Windows\System\SDbnRUb.exe
  2⤵
  PID:3936
- C:\Windows\System\niqOycX.exe
  C:\Windows\System\niqOycX.exe
  2⤵
  PID:2876
- C:\Windows\System\OjclztN.exe
  C:\Windows\System\OjclztN.exe
  2⤵
  PID:1552
- C:\Windows\System\xfNKiZa.exe
  C:\Windows\System\xfNKiZa.exe
  2⤵
  PID:4688
- C:\Windows\System\ikBRUan.exe
  C:\Windows\System\ikBRUan.exe
  2⤵
  PID:2964
- C:\Windows\System\hdCuYRx.exe
  C:\Windows\System\hdCuYRx.exe
  2⤵
  PID:5200
- C:\Windows\System\vtSvyuy.exe
  C:\Windows\System\vtSvyuy.exe
  2⤵
  PID:1380
- C:\Windows\System\mNDtIwx.exe
  C:\Windows\System\mNDtIwx.exe
  2⤵
  PID:1788
- C:\Windows\System\riZQoLK.exe
  C:\Windows\System\riZQoLK.exe
  2⤵
  PID:4544
- C:\Windows\System\dsrGUeH.exe
  C:\Windows\System\dsrGUeH.exe
  2⤵
  PID:5804
- C:\Windows\System\KHhCDJR.exe
  C:\Windows\System\KHhCDJR.exe
  2⤵
  PID:5460
- C:\Windows\System\QMPTcnm.exe
  C:\Windows\System\QMPTcnm.exe
  2⤵
  PID:5944
- C:\Windows\System\qgKwxnE.exe
  C:\Windows\System\qgKwxnE.exe
  2⤵
  PID:2452
- C:\Windows\System\VARFwEz.exe
  C:\Windows\System\VARFwEz.exe
  2⤵
  PID:2960
- C:\Windows\System\ALuMdWX.exe
  C:\Windows\System\ALuMdWX.exe
  2⤵
  PID:4936
- C:\Windows\System\jzqSzNR.exe
  C:\Windows\System\jzqSzNR.exe
  2⤵
  PID:5816
- C:\Windows\System\oJIdiWN.exe
  C:\Windows\System\oJIdiWN.exe
  2⤵
  PID:6156
- C:\Windows\System\zydjrNu.exe
  C:\Windows\System\zydjrNu.exe
  2⤵
  PID:6184
- C:\Windows\System\MCvwxcO.exe
  C:\Windows\System\MCvwxcO.exe
  2⤵
  PID:6200
- C:\Windows\System\HpIbbYg.exe
  C:\Windows\System\HpIbbYg.exe
  2⤵
  PID:6220
- C:\Windows\System\cCikPiE.exe
  C:\Windows\System\cCikPiE.exe
  2⤵
  PID:6240
- C:\Windows\System\JOKAYyX.exe
  C:\Windows\System\JOKAYyX.exe
  2⤵
  PID:6268
- C:\Windows\System\gjjRACQ.exe
  C:\Windows\System\gjjRACQ.exe
  2⤵
  PID:6288
- C:\Windows\System\iuacyWO.exe
  C:\Windows\System\iuacyWO.exe
  2⤵
  PID:6312
- C:\Windows\System\ibmBiNp.exe
  C:\Windows\System\ibmBiNp.exe
  2⤵
  PID:6336
- C:\Windows\System\BjsKcWV.exe
  C:\Windows\System\BjsKcWV.exe
  2⤵
  PID:6356
- C:\Windows\System\HJOmwpv.exe
  C:\Windows\System\HJOmwpv.exe
  2⤵
  PID:6384
- C:\Windows\System\BaGjjGU.exe
  C:\Windows\System\BaGjjGU.exe
  2⤵
  PID:6404
- C:\Windows\System\wLVFLfq.exe
  C:\Windows\System\wLVFLfq.exe
  2⤵
  PID:6428
- C:\Windows\System\jGfLUvT.exe
  C:\Windows\System\jGfLUvT.exe
  2⤵
  PID:6448
- C:\Windows\System\OPbqqwX.exe
  C:\Windows\System\OPbqqwX.exe
  2⤵
  PID:6468
- C:\Windows\System\bZjhTAu.exe
  C:\Windows\System\bZjhTAu.exe
  2⤵
  PID:6492
- C:\Windows\System\MqmBKNu.exe
  C:\Windows\System\MqmBKNu.exe
  2⤵
  PID:6516
- C:\Windows\System\kSlDYqx.exe
  C:\Windows\System\kSlDYqx.exe
  2⤵
  PID:6544
- C:\Windows\System\GBiAJEN.exe
  C:\Windows\System\GBiAJEN.exe
  2⤵
  PID:6564
- C:\Windows\System\Pdsrynu.exe
  C:\Windows\System\Pdsrynu.exe
  2⤵
  PID:6584
- C:\Windows\System\SeZbnEg.exe
  C:\Windows\System\SeZbnEg.exe
  2⤵
  PID:6608
- C:\Windows\System\BNZuSfh.exe
  C:\Windows\System\BNZuSfh.exe
  2⤵
  PID:6624
- C:\Windows\System\wnWvObQ.exe
  C:\Windows\System\wnWvObQ.exe
  2⤵
  PID:6648
- C:\Windows\System\yLpgezY.exe
  C:\Windows\System\yLpgezY.exe
  2⤵
  PID:6672
- C:\Windows\System\hkJOETF.exe
  C:\Windows\System\hkJOETF.exe
  2⤵
  PID:6696
- C:\Windows\System\cVdnRXG.exe
  C:\Windows\System\cVdnRXG.exe
  2⤵
  PID:6712
- C:\Windows\System\tjaVarp.exe
  C:\Windows\System\tjaVarp.exe
  2⤵
  PID:6736
- C:\Windows\System\aYuEAyC.exe
  C:\Windows\System\aYuEAyC.exe
  2⤵
  PID:6760
- C:\Windows\System\eOofgeG.exe
  C:\Windows\System\eOofgeG.exe
  2⤵
  PID:6776
- C:\Windows\System\gkEpMvo.exe
  C:\Windows\System\gkEpMvo.exe
  2⤵
  PID:6808
- C:\Windows\System\RRFPmBT.exe
  C:\Windows\System\RRFPmBT.exe
  2⤵
  PID:6836
- C:\Windows\System\UStFAeD.exe
  C:\Windows\System\UStFAeD.exe
  2⤵
  PID:6856
- C:\Windows\System\BiHCwWP.exe
  C:\Windows\System\BiHCwWP.exe
  2⤵
  PID:6884
- C:\Windows\System\XsSYaiR.exe
  C:\Windows\System\XsSYaiR.exe
  2⤵
  PID:6904
- C:\Windows\System\guRitam.exe
  C:\Windows\System\guRitam.exe
  2⤵
  PID:6920
- C:\Windows\System\oxSyIzs.exe
  C:\Windows\System\oxSyIzs.exe
  2⤵
  PID:6944
- C:\Windows\System\eaedROC.exe
  C:\Windows\System\eaedROC.exe
  2⤵
  PID:6960
- C:\Windows\System\RRJzYsa.exe
  C:\Windows\System\RRJzYsa.exe
  2⤵
  PID:6988
- C:\Windows\System\UEolYyD.exe
  C:\Windows\System\UEolYyD.exe
  2⤵
  PID:7012
- C:\Windows\System\UAQMcDI.exe
  C:\Windows\System\UAQMcDI.exe
  2⤵
  PID:7040
- C:\Windows\System\PUMXyie.exe
  C:\Windows\System\PUMXyie.exe
  2⤵
  PID:7056
- C:\Windows\System\FuycMeC.exe
  C:\Windows\System\FuycMeC.exe
  2⤵
  PID:7080
- C:\Windows\System\tsmEICp.exe
  C:\Windows\System\tsmEICp.exe
  2⤵
  PID:7104
- C:\Windows\System\JHWBxeV.exe
  C:\Windows\System\JHWBxeV.exe
  2⤵
  PID:7124
- C:\Windows\System\gCkHQTZ.exe
  C:\Windows\System\gCkHQTZ.exe
  2⤵
  PID:7152
- C:\Windows\System\qZzlaEE.exe
  C:\Windows\System\qZzlaEE.exe
  2⤵
  PID:5768
- C:\Windows\System\nNIgIBz.exe
  C:\Windows\System\nNIgIBz.exe
  2⤵
  PID:4320
- C:\Windows\System\mEyxTNu.exe
  C:\Windows\System\mEyxTNu.exe
  2⤵
  PID:3104
- C:\Windows\System\MtTAckJ.exe
  C:\Windows\System\MtTAckJ.exe
  2⤵
  PID:6116
- C:\Windows\System\sYIpxKV.exe
  C:\Windows\System\sYIpxKV.exe
  2⤵
  PID:2440
- C:\Windows\System\TIJwfCK.exe
  C:\Windows\System\TIJwfCK.exe
  2⤵
  PID:5856
- C:\Windows\System\KaZlDLc.exe
  C:\Windows\System\KaZlDLc.exe
  2⤵
  PID:1360
- C:\Windows\System\pXsKoMk.exe
  C:\Windows\System\pXsKoMk.exe
  2⤵
  PID:6164
- C:\Windows\System\fVJelCE.exe
  C:\Windows\System\fVJelCE.exe
  2⤵
  PID:5920
- C:\Windows\System\kKBUszw.exe
  C:\Windows\System\kKBUszw.exe
  2⤵
  PID:5284
- C:\Windows\System\JnSjqHb.exe
  C:\Windows\System\JnSjqHb.exe
  2⤵
  PID:6148
- C:\Windows\System\ORlvCXL.exe
  C:\Windows\System\ORlvCXL.exe
  2⤵
  PID:6232
- C:\Windows\System\rgIrOOj.exe
  C:\Windows\System\rgIrOOj.exe
  2⤵
  PID:6684
- C:\Windows\System\niPCYEn.exe
  C:\Windows\System\niPCYEn.exe
  2⤵
  PID:6260
- C:\Windows\System\hNCuoTK.exe
  C:\Windows\System\hNCuoTK.exe
  2⤵
  PID:6284
- C:\Windows\System\ZEpaJvd.exe
  C:\Windows\System\ZEpaJvd.exe
  2⤵
  PID:5456
- C:\Windows\System\tODRMcC.exe
  C:\Windows\System\tODRMcC.exe
  2⤵
  PID:392
- C:\Windows\System\ORaBhXa.exe
  C:\Windows\System\ORaBhXa.exe
  2⤵
  PID:6876
- C:\Windows\System\QzrWNOl.exe
  C:\Windows\System\QzrWNOl.exe
  2⤵
  PID:6912
- C:\Windows\System\CrpaXPy.exe
  C:\Windows\System\CrpaXPy.exe
  2⤵
  PID:6504
- C:\Windows\System\kmkoxaw.exe
  C:\Windows\System\kmkoxaw.exe
  2⤵
  PID:6976
- C:\Windows\System\QinyvIl.exe
  C:\Windows\System\QinyvIl.exe
  2⤵
  PID:6196
- C:\Windows\System\hhgbYfK.exe
  C:\Windows\System\hhgbYfK.exe
  2⤵
  PID:6620
- C:\Windows\System\elEVrBX.exe
  C:\Windows\System\elEVrBX.exe
  2⤵
  PID:7064
- C:\Windows\System\hjzxexy.exe
  C:\Windows\System\hjzxexy.exe
  2⤵
  PID:7076
- C:\Windows\System\KXfLMuq.exe
  C:\Windows\System\KXfLMuq.exe
  2⤵
  PID:7164
- C:\Windows\System\mcSJUsY.exe
  C:\Windows\System\mcSJUsY.exe
  2⤵
  PID:6744
- C:\Windows\System\lMQuOSI.exe
  C:\Windows\System\lMQuOSI.exe
  2⤵
  PID:6124
- C:\Windows\System\FOXaOKJ.exe
  C:\Windows\System\FOXaOKJ.exe
  2⤵
  PID:1108
- C:\Windows\System\oYgxjsH.exe
  C:\Windows\System\oYgxjsH.exe
  2⤵
  PID:6424
- C:\Windows\System\XLdFNaj.exe
  C:\Windows\System\XLdFNaj.exe
  2⤵
  PID:3972
- C:\Windows\System\gnVKQOX.exe
  C:\Windows\System\gnVKQOX.exe
  2⤵
  PID:7184
- C:\Windows\System\yQMaamj.exe
  C:\Windows\System\yQMaamj.exe
  2⤵
  PID:7208
- C:\Windows\System\etBCSaW.exe
  C:\Windows\System\etBCSaW.exe
  2⤵
  PID:7224
- C:\Windows\System\EcdqYkw.exe
  C:\Windows\System\EcdqYkw.exe
  2⤵
  PID:7252
- C:\Windows\System\xSZDUtI.exe
  C:\Windows\System\xSZDUtI.exe
  2⤵
  PID:7276
- C:\Windows\System\rvrMDYk.exe
  C:\Windows\System\rvrMDYk.exe
  2⤵
  PID:7296
- C:\Windows\System\XRjqKqQ.exe
  C:\Windows\System\XRjqKqQ.exe
  2⤵
  PID:7328
- C:\Windows\System\wAEFFee.exe
  C:\Windows\System\wAEFFee.exe
  2⤵
  PID:7344
- C:\Windows\System\MgDKjea.exe
  C:\Windows\System\MgDKjea.exe
  2⤵
  PID:7360
- C:\Windows\System\CyWWmqT.exe
  C:\Windows\System\CyWWmqT.exe
  2⤵
  PID:7380
- C:\Windows\System\sXsNkUf.exe
  C:\Windows\System\sXsNkUf.exe
  2⤵
  PID:7400
- C:\Windows\System\WKKNXfk.exe
  C:\Windows\System\WKKNXfk.exe
  2⤵
  PID:7424
- C:\Windows\System\UmtQqAT.exe
  C:\Windows\System\UmtQqAT.exe
  2⤵
  PID:7448
- C:\Windows\System\HirbFUY.exe
  C:\Windows\System\HirbFUY.exe
  2⤵
  PID:7464
- C:\Windows\System\IgLtKBH.exe
  C:\Windows\System\IgLtKBH.exe
  2⤵
  PID:7492
- C:\Windows\System\SqvgDhJ.exe
  C:\Windows\System\SqvgDhJ.exe
  2⤵
  PID:7516
- C:\Windows\System\ubANfEJ.exe
  C:\Windows\System\ubANfEJ.exe
  2⤵
  PID:7532
- C:\Windows\System\kmbntDE.exe
  C:\Windows\System\kmbntDE.exe
  2⤵
  PID:7556
- C:\Windows\System\YgjkYZc.exe
  C:\Windows\System\YgjkYZc.exe
  2⤵
  PID:7580
- C:\Windows\System\IAyeOiL.exe
  C:\Windows\System\IAyeOiL.exe
  2⤵
  PID:7604
- C:\Windows\System\uOuLoKj.exe
  C:\Windows\System\uOuLoKj.exe
  2⤵
  PID:7624
- C:\Windows\System\mcxiMir.exe
  C:\Windows\System\mcxiMir.exe
  2⤵
  PID:7644
- C:\Windows\System\dWtewzn.exe
  C:\Windows\System\dWtewzn.exe
  2⤵
  PID:7672
- C:\Windows\System\SZrUuoP.exe
  C:\Windows\System\SZrUuoP.exe
  2⤵
  PID:7860
- C:\Windows\System\zsfLOUp.exe
  C:\Windows\System\zsfLOUp.exe
  2⤵
  PID:7928
- C:\Windows\System\sYQtxGN.exe
  C:\Windows\System\sYQtxGN.exe
  2⤵
  PID:7948
- C:\Windows\System\pynlxdJ.exe
  C:\Windows\System\pynlxdJ.exe
  2⤵
  PID:7972
- C:\Windows\System\ZOagYPg.exe
  C:\Windows\System\ZOagYPg.exe
  2⤵
  PID:7996
- C:\Windows\System\dKXXKHC.exe
  C:\Windows\System\dKXXKHC.exe
  2⤵
  PID:8016
- C:\Windows\System\emqvVst.exe
  C:\Windows\System\emqvVst.exe
  2⤵
  PID:8040
- C:\Windows\System\ABfDiom.exe
  C:\Windows\System\ABfDiom.exe
  2⤵
  PID:8064
- C:\Windows\System\RtbrKeL.exe
  C:\Windows\System\RtbrKeL.exe
  2⤵
  PID:8088
- C:\Windows\System\tiGTjQU.exe
  C:\Windows\System\tiGTjQU.exe
  2⤵
  PID:8108
- C:\Windows\System\aSBKYsl.exe
  C:\Windows\System\aSBKYsl.exe
  2⤵
  PID:8132
- C:\Windows\System\swIXaUt.exe
  C:\Windows\System\swIXaUt.exe
  2⤵
  PID:8160
- C:\Windows\System\eZbQsAR.exe
  C:\Windows\System\eZbQsAR.exe
  2⤵
  PID:8184
- C:\Windows\System\iAoilKi.exe
  C:\Windows\System\iAoilKi.exe
  2⤵
  PID:6488
- C:\Windows\System\WfmDUcB.exe
  C:\Windows\System\WfmDUcB.exe
  2⤵
  PID:4684
- C:\Windows\System\xJXhloK.exe
  C:\Windows\System\xJXhloK.exe
  2⤵
  PID:6748
- C:\Windows\System\DEaerzF.exe
  C:\Windows\System\DEaerzF.exe
  2⤵
  PID:6968
- C:\Windows\System\rnimYmH.exe
  C:\Windows\System\rnimYmH.exe
  2⤵
  PID:7244
- C:\Windows\System\NcIynQa.exe
  C:\Windows\System\NcIynQa.exe
  2⤵
  PID:6324
- C:\Windows\System\TaLfaDc.exe
  C:\Windows\System\TaLfaDc.exe
  2⤵
  PID:7100
- C:\Windows\System\GGsgJcW.exe
  C:\Windows\System\GGsgJcW.exe
  2⤵
  PID:6560
- C:\Windows\System\KTRHdKj.exe
  C:\Windows\System\KTRHdKj.exe
  2⤵
  PID:7028
- C:\Windows\System\LCsiQeJ.exe
  C:\Windows\System\LCsiQeJ.exe
  2⤵
  PID:7176
- C:\Windows\System\oNKavlI.exe
  C:\Windows\System\oNKavlI.exe
  2⤵
  PID:7160
- C:\Windows\System\EJBmBFx.exe
  C:\Windows\System\EJBmBFx.exe
  2⤵
  PID:5696
- C:\Windows\System\mCCjmGG.exe
  C:\Windows\System\mCCjmGG.exe
  2⤵
  PID:7268
- C:\Windows\System\houmKpH.exe
  C:\Windows\System\houmKpH.exe
  2⤵
  PID:6656
- C:\Windows\System\XtJZJlm.exe
  C:\Windows\System\XtJZJlm.exe
  2⤵
  PID:8196
- C:\Windows\System\ThjQfWh.exe
  C:\Windows\System\ThjQfWh.exe
  2⤵
  PID:8216
- C:\Windows\System\slujTJW.exe
  C:\Windows\System\slujTJW.exe
  2⤵
  PID:8236
- C:\Windows\System\akzkbqb.exe
  C:\Windows\System\akzkbqb.exe
  2⤵
  PID:8256
- C:\Windows\System\JNMJjWn.exe
  C:\Windows\System\JNMJjWn.exe
  2⤵
  PID:8276
- C:\Windows\System\jteQPdb.exe
  C:\Windows\System\jteQPdb.exe
  2⤵
  PID:8308
- C:\Windows\System\yCksEEP.exe
  C:\Windows\System\yCksEEP.exe
  2⤵
  PID:8336
- C:\Windows\System\doQDhtp.exe
  C:\Windows\System\doQDhtp.exe
  2⤵
  PID:8360
- C:\Windows\System\qtmIJVp.exe
  C:\Windows\System\qtmIJVp.exe
  2⤵
  PID:8388
- C:\Windows\System\VjaQHOH.exe
  C:\Windows\System\VjaQHOH.exe
  2⤵
  PID:8408
- C:\Windows\System\QRognUF.exe
  C:\Windows\System\QRognUF.exe
  2⤵
  PID:8436
- C:\Windows\System\iHYsoKL.exe
  C:\Windows\System\iHYsoKL.exe
  2⤵
  PID:8464
- C:\Windows\System\RzkMsNz.exe
  C:\Windows\System\RzkMsNz.exe
  2⤵
  PID:8488
- C:\Windows\System\NTpUVtx.exe
  C:\Windows\System\NTpUVtx.exe
  2⤵
  PID:8512
- C:\Windows\System\nsAmxqR.exe
  C:\Windows\System\nsAmxqR.exe
  2⤵
  PID:8532
- C:\Windows\System\dUXhlSW.exe
  C:\Windows\System\dUXhlSW.exe
  2⤵
  PID:8560
- C:\Windows\System\oMycerq.exe
  C:\Windows\System\oMycerq.exe
  2⤵
  PID:8584
- C:\Windows\System\EsaOlXM.exe
  C:\Windows\System\EsaOlXM.exe
  2⤵
  PID:8604
- C:\Windows\System\ByZKhqU.exe
  C:\Windows\System\ByZKhqU.exe
  2⤵
  PID:8632
- C:\Windows\System\oVQDKtx.exe
  C:\Windows\System\oVQDKtx.exe
  2⤵
  PID:8652
- C:\Windows\System\piRppdW.exe
  C:\Windows\System\piRppdW.exe
  2⤵
  PID:8668
- C:\Windows\System\BzNExCM.exe
  C:\Windows\System\BzNExCM.exe
  2⤵
  PID:8692
- C:\Windows\System\pURbjXZ.exe
  C:\Windows\System\pURbjXZ.exe
  2⤵
  PID:8712
- C:\Windows\System\GHbTgfZ.exe
  C:\Windows\System\GHbTgfZ.exe
  2⤵
  PID:8736
- C:\Windows\System\iBSxOjv.exe
  C:\Windows\System\iBSxOjv.exe
  2⤵
  PID:8768
- C:\Windows\System\UaNlcXe.exe
  C:\Windows\System\UaNlcXe.exe
  2⤵
  PID:8792
- C:\Windows\System\IEWSfEd.exe
  C:\Windows\System\IEWSfEd.exe
  2⤵
  PID:8812
- C:\Windows\System\UMpyKqk.exe
  C:\Windows\System\UMpyKqk.exe
  2⤵
  PID:8836
- C:\Windows\System\HtltYEr.exe
  C:\Windows\System\HtltYEr.exe
  2⤵
  PID:8864
- C:\Windows\System\CdBQTaM.exe
  C:\Windows\System\CdBQTaM.exe
  2⤵
  PID:8892
- C:\Windows\System\oujNOVh.exe
  C:\Windows\System\oujNOVh.exe
  2⤵
  PID:8916
- C:\Windows\System\QYjqsNv.exe
  C:\Windows\System\QYjqsNv.exe
  2⤵
  PID:8940
- C:\Windows\System\ilsXCEj.exe
  C:\Windows\System\ilsXCEj.exe
  2⤵
  PID:8960
- C:\Windows\System\KNRtAGs.exe
  C:\Windows\System\KNRtAGs.exe
  2⤵
  PID:8980
- C:\Windows\System\yuChzjH.exe
  C:\Windows\System\yuChzjH.exe
  2⤵
  PID:9004
- C:\Windows\System\EBuPCaL.exe
  C:\Windows\System\EBuPCaL.exe
  2⤵
  PID:9020
- C:\Windows\System\lZHvRNe.exe
  C:\Windows\System\lZHvRNe.exe
  2⤵
  PID:9036
- C:\Windows\System\gkeDSKt.exe
  C:\Windows\System\gkeDSKt.exe
  2⤵
  PID:9064
- C:\Windows\System\XwLgbPV.exe
  C:\Windows\System\XwLgbPV.exe
  2⤵
  PID:9084
- C:\Windows\System\OTEPfNY.exe
  C:\Windows\System\OTEPfNY.exe
  2⤵
  PID:9108
- C:\Windows\System\gjmrKQE.exe
  C:\Windows\System\gjmrKQE.exe
  2⤵
  PID:9136
- C:\Windows\System\Rabaxny.exe
  C:\Windows\System\Rabaxny.exe
  2⤵
  PID:9156
- C:\Windows\System\UHgrgmx.exe
  C:\Windows\System\UHgrgmx.exe
  2⤵
  PID:9180
- C:\Windows\System\FwdMxRp.exe
  C:\Windows\System\FwdMxRp.exe
  2⤵
  PID:9200
- C:\Windows\System\futSyIV.exe
  C:\Windows\System\futSyIV.exe
  2⤵
  PID:7572
- C:\Windows\System\BjqWRTl.exe
  C:\Windows\System\BjqWRTl.exe
  2⤵
  PID:7504
- C:\Windows\System\lsHqCZl.exe
  C:\Windows\System\lsHqCZl.exe
  2⤵
  PID:7392
- C:\Windows\System\diojsNe.exe
  C:\Windows\System\diojsNe.exe
  2⤵
  PID:7288
- C:\Windows\System\vAuhkPg.exe
  C:\Windows\System\vAuhkPg.exe
  2⤵
  PID:7916
- C:\Windows\System\hoYZRzF.exe
  C:\Windows\System\hoYZRzF.exe
  2⤵
  PID:6728
- C:\Windows\System\dxKBgOC.exe
  C:\Windows\System\dxKBgOC.exe
  2⤵
  PID:7956
- C:\Windows\System\eByrDpG.exe
  C:\Windows\System\eByrDpG.exe
  2⤵
  PID:8080
- C:\Windows\System\bpeeaUS.exe
  C:\Windows\System\bpeeaUS.exe
  2⤵
  PID:8228
- C:\Windows\System\tDzTtcJ.exe
  C:\Windows\System\tDzTtcJ.exe
  2⤵
  PID:8320
- C:\Windows\System\LFPdInO.exe
  C:\Windows\System\LFPdInO.exe
  2⤵
  PID:8332
- C:\Windows\System\EyknoUs.exe
  C:\Windows\System\EyknoUs.exe
  2⤵
  PID:7924
- C:\Windows\System\xSgpwCc.exe
  C:\Windows\System\xSgpwCc.exe
  2⤵
  PID:7964
- C:\Windows\System\NzhLMuy.exe
  C:\Windows\System\NzhLMuy.exe
  2⤵
  PID:8524
- C:\Windows\System\ipPcHyu.exe
  C:\Windows\System\ipPcHyu.exe
  2⤵
  PID:6216
- C:\Windows\System\OliAiFj.exe
  C:\Windows\System\OliAiFj.exe
  2⤵
  PID:8808
- C:\Windows\System\FzqLoHc.exe
  C:\Windows\System\FzqLoHc.exe
  2⤵
  PID:8876
- C:\Windows\System\WZWGZAL.exe
  C:\Windows\System\WZWGZAL.exe
  2⤵
  PID:8952
- C:\Windows\System\FSfeHpl.exe
  C:\Windows\System\FSfeHpl.exe
  2⤵
  PID:8996
- C:\Windows\System\exyYyDT.exe
  C:\Windows\System\exyYyDT.exe
  2⤵
  PID:9128
- C:\Windows\System\yTTniiz.exe
  C:\Windows\System\yTTniiz.exe
  2⤵
  PID:6512
- C:\Windows\System\YIaFpWS.exe
  C:\Windows\System\YIaFpWS.exe
  2⤵
  PID:9224
- C:\Windows\System\vzYZlJx.exe
  C:\Windows\System\vzYZlJx.exe
  2⤵
  PID:9248
- C:\Windows\System\rkkaJSD.exe
  C:\Windows\System\rkkaJSD.exe
  2⤵
  PID:9268
- C:\Windows\System\esyElVk.exe
  C:\Windows\System\esyElVk.exe
  2⤵
  PID:9300
- C:\Windows\System\WAKVwnL.exe
  C:\Windows\System\WAKVwnL.exe
  2⤵
  PID:9324
- C:\Windows\System\NpIuJOQ.exe
  C:\Windows\System\NpIuJOQ.exe
  2⤵
  PID:9344
- C:\Windows\System\aZjBWQU.exe
  C:\Windows\System\aZjBWQU.exe
  2⤵
  PID:9368
- C:\Windows\System\QoIAGPg.exe
  C:\Windows\System\QoIAGPg.exe
  2⤵
  PID:9388
- C:\Windows\System\dHVeafc.exe
  C:\Windows\System\dHVeafc.exe
  2⤵
  PID:9408
- C:\Windows\System\bWBHKXq.exe
  C:\Windows\System\bWBHKXq.exe
  2⤵
  PID:9428
- C:\Windows\System\eCxQnNZ.exe
  C:\Windows\System\eCxQnNZ.exe
  2⤵
  PID:9452
- C:\Windows\System\CZEQMIm.exe
  C:\Windows\System\CZEQMIm.exe
  2⤵
  PID:9476
- C:\Windows\System\ArWjbky.exe
  C:\Windows\System\ArWjbky.exe
  2⤵
  PID:9500
- C:\Windows\System\EXLclAA.exe
  C:\Windows\System\EXLclAA.exe
  2⤵
  PID:9524
- C:\Windows\System\ZQiJKIV.exe
  C:\Windows\System\ZQiJKIV.exe
  2⤵
  PID:9552
- C:\Windows\System\UJileAD.exe
  C:\Windows\System\UJileAD.exe
  2⤵
  PID:9576
- C:\Windows\System\dFCkDNp.exe
  C:\Windows\System\dFCkDNp.exe
  2⤵
  PID:9616
- C:\Windows\System\iuZpLwM.exe
  C:\Windows\System\iuZpLwM.exe
  2⤵
  PID:9636
- C:\Windows\System\ABMtVCa.exe
  C:\Windows\System\ABMtVCa.exe
  2⤵
  PID:9664
- C:\Windows\System\vKIEHmT.exe
  C:\Windows\System\vKIEHmT.exe
  2⤵
  PID:9688
- C:\Windows\System\rZUnopu.exe
  C:\Windows\System\rZUnopu.exe
  2⤵
  PID:9712
- C:\Windows\System\AhBTDUy.exe
  C:\Windows\System\AhBTDUy.exe
  2⤵
  PID:9732
- C:\Windows\System\zHOQQai.exe
  C:\Windows\System\zHOQQai.exe
  2⤵
  PID:9760
- C:\Windows\System\DZrdwTQ.exe
  C:\Windows\System\DZrdwTQ.exe
  2⤵
  PID:9792
- C:\Windows\System\oQEEdeY.exe
  C:\Windows\System\oQEEdeY.exe
  2⤵
  PID:9816
- C:\Windows\System\cmQpyBN.exe
  C:\Windows\System\cmQpyBN.exe
  2⤵
  PID:9848
- C:\Windows\System\oMhoWXZ.exe
  C:\Windows\System\oMhoWXZ.exe
  2⤵
  PID:9864
- C:\Windows\System\qtjGwKb.exe
  C:\Windows\System\qtjGwKb.exe
  2⤵
  PID:9884
- C:\Windows\System\maoQSwe.exe
  C:\Windows\System\maoQSwe.exe
  2⤵
  PID:9904
- C:\Windows\System\NGdglyS.exe
  C:\Windows\System\NGdglyS.exe
  2⤵
  PID:9928
- C:\Windows\System\ZNEydcp.exe
  C:\Windows\System\ZNEydcp.exe
  2⤵
  PID:9948
- C:\Windows\System\icUVouK.exe
  C:\Windows\System\icUVouK.exe
  2⤵
  PID:9972
- C:\Windows\System\PDMbWhq.exe
  C:\Windows\System\PDMbWhq.exe
  2⤵
  PID:9996
- C:\Windows\System\feDPsyR.exe
  C:\Windows\System\feDPsyR.exe
  2⤵
  PID:10016
- C:\Windows\System\MjfrAec.exe
  C:\Windows\System\MjfrAec.exe
  2⤵
  PID:10040
- C:\Windows\System\OwxsAJd.exe
  C:\Windows\System\OwxsAJd.exe
  2⤵
  PID:10060
- C:\Windows\System\XzSSYNv.exe
  C:\Windows\System\XzSSYNv.exe
  2⤵
  PID:10084
- C:\Windows\System\YRXzkJf.exe
  C:\Windows\System\YRXzkJf.exe
  2⤵
  PID:10104
- C:\Windows\System\NalNDqV.exe
  C:\Windows\System\NalNDqV.exe
  2⤵
  PID:10124
- C:\Windows\System\txTkzWR.exe
  C:\Windows\System\txTkzWR.exe
  2⤵
  PID:10152
- C:\Windows\System\WbQfqOp.exe
  C:\Windows\System\WbQfqOp.exe
  2⤵
  PID:10176
- C:\Windows\System\zkRMwvg.exe
  C:\Windows\System\zkRMwvg.exe
  2⤵
  PID:10204
- C:\Windows\System\SgjgpGm.exe
  C:\Windows\System\SgjgpGm.exe
  2⤵
  PID:10232
- C:\Windows\System\CWAXVyH.exe
  C:\Windows\System\CWAXVyH.exe
  2⤵
  PID:7052
- C:\Windows\System\ppVuGpe.exe
  C:\Windows\System\ppVuGpe.exe
  2⤵
  PID:8028
- C:\Windows\System\zcDXcmK.exe
  C:\Windows\System\zcDXcmK.exe
  2⤵
  PID:8128
- C:\Windows\System\AiVNnUm.exe
  C:\Windows\System\AiVNnUm.exe
  2⤵
  PID:8476
- C:\Windows\System\oqUxSuD.exe
  C:\Windows\System\oqUxSuD.exe
  2⤵
  PID:8528
- C:\Windows\System\hAjEKBT.exe
  C:\Windows\System\hAjEKBT.exe
  2⤵
  PID:5712
- C:\Windows\System\gvCoBMS.exe
  C:\Windows\System\gvCoBMS.exe
  2⤵
  PID:6320
- C:\Windows\System\RcKaiuM.exe
  C:\Windows\System\RcKaiuM.exe
  2⤵
  PID:6444
- C:\Windows\System\NluTMOE.exe
  C:\Windows\System\NluTMOE.exe
  2⤵
  PID:6720
- C:\Windows\System\utOwUbY.exe
  C:\Windows\System\utOwUbY.exe
  2⤵
  PID:6176
- C:\Windows\System\JhPugoT.exe
  C:\Windows\System\JhPugoT.exe
  2⤵
  PID:7472
- C:\Windows\System\jBCZDpQ.exe
  C:\Windows\System\jBCZDpQ.exe
  2⤵
  PID:9052
- C:\Windows\System\ZVFNGua.exe
  C:\Windows\System\ZVFNGua.exe
  2⤵
  PID:8872
- C:\Windows\System\yihYTHn.exe
  C:\Windows\System\yihYTHn.exe
  2⤵
  PID:9116
- C:\Windows\System\yXyZjIo.exe
  C:\Windows\System\yXyZjIo.exe
  2⤵
  PID:6768
- C:\Windows\System\CSkVlYO.exe
  C:\Windows\System\CSkVlYO.exe
  2⤵
  PID:9312
- C:\Windows\System\WusoLjY.exe
  C:\Windows\System\WusoLjY.exe
  2⤵
  PID:9364
- C:\Windows\System\kcozvFR.exe
  C:\Windows\System\kcozvFR.exe
  2⤵
  PID:3708
- C:\Windows\System\fLLBcHM.exe
  C:\Windows\System\fLLBcHM.exe
  2⤵
  PID:7756
- C:\Windows\System\CCweckn.exe
  C:\Windows\System\CCweckn.exe
  2⤵
  PID:8684
- C:\Windows\System\amtMKqx.exe
  C:\Windows\System\amtMKqx.exe
  2⤵
  PID:9672
- C:\Windows\System\LhMoAZt.exe
  C:\Windows\System\LhMoAZt.exe
  2⤵
  PID:8760
- C:\Windows\System\Wgochzn.exe
  C:\Windows\System\Wgochzn.exe
  2⤵
  PID:7800
- C:\Windows\System\qxBmHyo.exe
  C:\Windows\System\qxBmHyo.exe
  2⤵
  PID:8828
- C:\Windows\System\XnlgxCd.exe
  C:\Windows\System\XnlgxCd.exe
  2⤵
  PID:8900
- C:\Windows\System\oKajzoG.exe
  C:\Windows\System\oKajzoG.exe
  2⤵
  PID:10252
- C:\Windows\System\BdDbrvK.exe
  C:\Windows\System\BdDbrvK.exe
  2⤵
  PID:10276
- C:\Windows\System\rZnwObx.exe
  C:\Windows\System\rZnwObx.exe
  2⤵
  PID:10296
- C:\Windows\System\MBhafxZ.exe
  C:\Windows\System\MBhafxZ.exe
  2⤵
  PID:10316
- C:\Windows\System\MpzKKQh.exe
  C:\Windows\System\MpzKKQh.exe
  2⤵
  PID:10340
- C:\Windows\System\WHLuLMm.exe
  C:\Windows\System\WHLuLMm.exe
  2⤵
  PID:10364
- C:\Windows\System\YuQshcB.exe
  C:\Windows\System\YuQshcB.exe
  2⤵
  PID:10384
- C:\Windows\System\XvytuRY.exe
  C:\Windows\System\XvytuRY.exe
  2⤵
  PID:10408
- C:\Windows\System\CSQHXqD.exe
  C:\Windows\System\CSQHXqD.exe
  2⤵
  PID:10436
- C:\Windows\System\DUQZaXY.exe
  C:\Windows\System\DUQZaXY.exe
  2⤵
  PID:10456
- C:\Windows\System\sErVygO.exe
  C:\Windows\System\sErVygO.exe
  2⤵
  PID:10476
- C:\Windows\System\eQdRjMd.exe
  C:\Windows\System\eQdRjMd.exe
  2⤵
  PID:10504
- C:\Windows\System\RoltIHD.exe
  C:\Windows\System\RoltIHD.exe
  2⤵
  PID:10524
- C:\Windows\System\zZbILUD.exe
  C:\Windows\System\zZbILUD.exe
  2⤵
  PID:10548
- C:\Windows\System\tXANBTp.exe
  C:\Windows\System\tXANBTp.exe
  2⤵
  PID:10572
- C:\Windows\System\BddgjUX.exe
  C:\Windows\System\BddgjUX.exe
  2⤵
  PID:10592
- C:\Windows\System\AObfhRv.exe
  C:\Windows\System\AObfhRv.exe
  2⤵
  PID:10612
- C:\Windows\System\ZnZJfZj.exe
  C:\Windows\System\ZnZJfZj.exe
  2⤵
  PID:10632
- C:\Windows\System\QTvGaCa.exe
  C:\Windows\System\QTvGaCa.exe
  2⤵
  PID:10656
- C:\Windows\System\aSTiGSa.exe
  C:\Windows\System\aSTiGSa.exe
  2⤵
  PID:10680
- C:\Windows\System\GwCteZc.exe
  C:\Windows\System\GwCteZc.exe
  2⤵
  PID:11056
- C:\Windows\System\IrXUvvB.exe
  C:\Windows\System\IrXUvvB.exe
  2⤵
  PID:11072
- C:\Windows\System\ZysfXQH.exe
  C:\Windows\System\ZysfXQH.exe
  2⤵
  PID:11096
- C:\Windows\System\JRrQjga.exe
  C:\Windows\System\JRrQjga.exe
  2⤵
  PID:11116
- C:\Windows\System\ngthHEf.exe
  C:\Windows\System\ngthHEf.exe
  2⤵
  PID:11136
- C:\Windows\System\nwzVYaA.exe
  C:\Windows\System\nwzVYaA.exe
  2⤵
  PID:11160
- C:\Windows\System\VuuHotC.exe
  C:\Windows\System\VuuHotC.exe
  2⤵
  PID:11188
- C:\Windows\System\DIbRTtb.exe
  C:\Windows\System\DIbRTtb.exe
  2⤵
  PID:11212
- C:\Windows\System\NeikhQF.exe
  C:\Windows\System\NeikhQF.exe
  2⤵
  PID:11244
- C:\Windows\System\olpWDDD.exe
  C:\Windows\System\olpWDDD.exe
  2⤵
  PID:9836
- C:\Windows\System\efQtymC.exe
  C:\Windows\System\efQtymC.exe
  2⤵
  PID:2908
- C:\Windows\System\TyFSlzv.exe
  C:\Windows\System\TyFSlzv.exe
  2⤵
  PID:1840
- C:\Windows\System\SWWGJvD.exe
  C:\Windows\System\SWWGJvD.exe
  2⤵
  PID:10012
- C:\Windows\System\gMZVpGm.exe
  C:\Windows\System\gMZVpGm.exe
  2⤵
  PID:9152
- C:\Windows\System\EYMxGcm.exe
  C:\Windows\System\EYMxGcm.exe
  2⤵
  PID:10056
- C:\Windows\System\ZcQbggC.exe
  C:\Windows\System\ZcQbggC.exe
  2⤵
  PID:4296
- C:\Windows\System\munHoNt.exe
  C:\Windows\System\munHoNt.exe
  2⤵
  PID:9092
- C:\Windows\System\OwkGHlV.exe
  C:\Windows\System\OwkGHlV.exe
  2⤵
  PID:7892
- C:\Windows\System\llJXqbp.exe
  C:\Windows\System\llJXqbp.exe
  2⤵
  PID:7908
- C:\Windows\System\BNALqVV.exe
  C:\Windows\System\BNALqVV.exe
  2⤵
  PID:9316
- C:\Windows\System\aKSHSGd.exe
  C:\Windows\System\aKSHSGd.exe
  2⤵
  PID:8548
- C:\Windows\System\zqWoQOR.exe
  C:\Windows\System\zqWoQOR.exe
  2⤵
  PID:9384
- C:\Windows\System\ISCcEYh.exe
  C:\Windows\System\ISCcEYh.exe
  2⤵
  PID:9488
- C:\Windows\System\jyddYAc.exe
  C:\Windows\System\jyddYAc.exe
  2⤵
  PID:9284
- C:\Windows\System\wOqvwrl.exe
  C:\Windows\System\wOqvwrl.exe
  2⤵
  PID:7868
- C:\Windows\System\vgmAVCp.exe
  C:\Windows\System\vgmAVCp.exe
  2⤵
  PID:10400
- C:\Windows\System\mcVMxyv.exe
  C:\Windows\System\mcVMxyv.exe
  2⤵
  PID:10472
- C:\Windows\System\fALaVFG.exe
  C:\Windows\System\fALaVFG.exe
  2⤵
  PID:8728
- C:\Windows\System\ECTmGkD.exe
  C:\Windows\System\ECTmGkD.exe
  2⤵
  PID:10600
- C:\Windows\System\lDLFEIR.exe
  C:\Windows\System\lDLFEIR.exe
  2⤵
  PID:1148
- C:\Windows\System\aftogUw.exe
  C:\Windows\System\aftogUw.exe
  2⤵
  PID:9260
- C:\Windows\System\PdMoIYF.exe
  C:\Windows\System\PdMoIYF.exe
  2⤵
  PID:10752
- C:\Windows\System\lylZTku.exe
  C:\Windows\System\lylZTku.exe
  2⤵
  PID:9436
- C:\Windows\System\uENzhDJ.exe
  C:\Windows\System\uENzhDJ.exe
  2⤵
  PID:3424
- C:\Windows\System\xAdsXLn.exe
  C:\Windows\System\xAdsXLn.exe
  2⤵
  PID:9696
- C:\Windows\System\LHaqUNi.exe
  C:\Windows\System\LHaqUNi.exe
  2⤵
  PID:9776
- C:\Windows\System\qAPcbAx.exe
  C:\Windows\System\qAPcbAx.exe
  2⤵
  PID:2240
- C:\Windows\System\WGulZaJ.exe
  C:\Windows\System\WGulZaJ.exe
  2⤵
  PID:11292
- C:\Windows\System\fXeBoyC.exe
  C:\Windows\System\fXeBoyC.exe
  2⤵
  PID:11316
- C:\Windows\System\tnKMKaM.exe
  C:\Windows\System\tnKMKaM.exe
  2⤵
  PID:11336
- C:\Windows\System\AziGusJ.exe
  C:\Windows\System\AziGusJ.exe
  2⤵
  PID:11360
- C:\Windows\System\RdhrzeJ.exe
  C:\Windows\System\RdhrzeJ.exe
  2⤵
  PID:11384
- C:\Windows\System\cUEGCef.exe
  C:\Windows\System\cUEGCef.exe
  2⤵
  PID:11404
- C:\Windows\System\gZukXxU.exe
  C:\Windows\System\gZukXxU.exe
  2⤵
  PID:11428
- C:\Windows\System\bVnhteo.exe
  C:\Windows\System\bVnhteo.exe
  2⤵
  PID:11448
- C:\Windows\System\kTBakVS.exe
  C:\Windows\System\kTBakVS.exe
  2⤵
  PID:11472
- C:\Windows\System\ERIMoJN.exe
  C:\Windows\System\ERIMoJN.exe
  2⤵
  PID:11496
- C:\Windows\System\SjlLdfT.exe
  C:\Windows\System\SjlLdfT.exe
  2⤵
  PID:11516
- C:\Windows\System\xBYqVRQ.exe
  C:\Windows\System\xBYqVRQ.exe
  2⤵
  PID:11536
- C:\Windows\System\xTqmfDl.exe
  C:\Windows\System\xTqmfDl.exe
  2⤵
  PID:11560
- C:\Windows\System\VUvykby.exe
  C:\Windows\System\VUvykby.exe
  2⤵
  PID:11576
- C:\Windows\System\UldeBnF.exe
  C:\Windows\System\UldeBnF.exe
  2⤵
  PID:11592
- C:\Windows\System\AJHoKlm.exe
  C:\Windows\System\AJHoKlm.exe
  2⤵
  PID:11608
- C:\Windows\System\QKtYYtN.exe
  C:\Windows\System\QKtYYtN.exe
  2⤵
  PID:11624
- C:\Windows\System\AUFisBb.exe
  C:\Windows\System\AUFisBb.exe
  2⤵
  PID:11640
- C:\Windows\System\boXwbAd.exe
  C:\Windows\System\boXwbAd.exe
  2⤵
  PID:11656
- C:\Windows\System\TdzJuZy.exe
  C:\Windows\System\TdzJuZy.exe
  2⤵
  PID:11672
- C:\Windows\System\XQKJqia.exe
  C:\Windows\System\XQKJqia.exe
  2⤵
  PID:11700
- C:\Windows\System\lmSQgnY.exe
  C:\Windows\System\lmSQgnY.exe
  2⤵
  PID:11720
- C:\Windows\System\zlzlAgC.exe
  C:\Windows\System\zlzlAgC.exe
  2⤵
  PID:11740
- C:\Windows\System\uUgXsGv.exe
  C:\Windows\System\uUgXsGv.exe
  2⤵
  PID:11760
- C:\Windows\System\oPQeQtu.exe
  C:\Windows\System\oPQeQtu.exe
  2⤵
  PID:11784
- C:\Windows\System\BrkZajt.exe
  C:\Windows\System\BrkZajt.exe
  2⤵
  PID:11804
- C:\Windows\System\PBarkNJ.exe
  C:\Windows\System\PBarkNJ.exe
  2⤵
  PID:11824
- C:\Windows\System\HRzdMDx.exe
  C:\Windows\System\HRzdMDx.exe
  2⤵
  PID:11848
- C:\Windows\System\YQsIycI.exe
  C:\Windows\System\YQsIycI.exe
  2⤵
  PID:11872
- C:\Windows\System\dVLanhS.exe
  C:\Windows\System\dVLanhS.exe
  2⤵
  PID:11896
- C:\Windows\System\tcoGLFY.exe
  C:\Windows\System\tcoGLFY.exe
  2⤵
  PID:11920
- C:\Windows\System\rtmHCRf.exe
  C:\Windows\System\rtmHCRf.exe
  2⤵
  PID:11948
- C:\Windows\System\IkLdHCI.exe
  C:\Windows\System\IkLdHCI.exe
  2⤵
  PID:11972
- C:\Windows\System\qCRgNwK.exe
  C:\Windows\System\qCRgNwK.exe
  2⤵
  PID:12004
- C:\Windows\System\XZZotnA.exe
  C:\Windows\System\XZZotnA.exe
  2⤵
  PID:12024
- C:\Windows\System\hjvnnTB.exe
  C:\Windows\System\hjvnnTB.exe
  2⤵
  PID:12048
- C:\Windows\System\pQcqwxA.exe
  C:\Windows\System\pQcqwxA.exe
  2⤵
  PID:12076
- C:\Windows\System\DFvZlxh.exe
  C:\Windows\System\DFvZlxh.exe
  2⤵
  PID:12096
- C:\Windows\System\oRKRIvc.exe
  C:\Windows\System\oRKRIvc.exe
  2⤵
  PID:12120
- C:\Windows\System\YMEvraP.exe
  C:\Windows\System\YMEvraP.exe
  2⤵
  PID:12140
- C:\Windows\System\xRvCPPa.exe
  C:\Windows\System\xRvCPPa.exe
  2⤵
  PID:12164
- C:\Windows\System\LJbNDFW.exe
  C:\Windows\System\LJbNDFW.exe
  2⤵
  PID:12192
- C:\Windows\System\CisJpid.exe
  C:\Windows\System\CisJpid.exe
  2⤵
  PID:12216
- C:\Windows\System\UGWidbe.exe
  C:\Windows\System\UGWidbe.exe
  2⤵
  PID:12240
- C:\Windows\System\JEHcYUa.exe
  C:\Windows\System\JEHcYUa.exe
  2⤵
  PID:12268
- C:\Windows\System\fPZUfDc.exe
  C:\Windows\System\fPZUfDc.exe
  2⤵
  PID:9920
- C:\Windows\System\txytxaO.exe
  C:\Windows\System\txytxaO.exe
  2⤵
  PID:9980
- C:\Windows\System\uzUMbPA.exe
  C:\Windows\System\uzUMbPA.exe
  2⤵
  PID:10096
- C:\Windows\System\FZMKzWt.exe
  C:\Windows\System\FZMKzWt.exe
  2⤵
  PID:10648
- C:\Windows\System\smMveLv.exe
  C:\Windows\System\smMveLv.exe
  2⤵
  PID:10716
- C:\Windows\System\FnRKfaq.exe
  C:\Windows\System\FnRKfaq.exe
  2⤵
  PID:11124
- C:\Windows\System\JZcEpxE.exe
  C:\Windows\System\JZcEpxE.exe
  2⤵
  PID:11252
- C:\Windows\System\JsMRDru.exe
  C:\Windows\System\JsMRDru.exe
  2⤵
  PID:8420
- C:\Windows\System\QaPkRec.exe
  C:\Windows\System\QaPkRec.exe
  2⤵
  PID:10784
- C:\Windows\System\JvxNMOr.exe
  C:\Windows\System\JvxNMOr.exe
  2⤵
  PID:10144
- C:\Windows\System\qfYZCmU.exe
  C:\Windows\System\qfYZCmU.exe
  2⤵
  PID:9400
- C:\Windows\System\LyNMBIM.exe
  C:\Windows\System\LyNMBIM.exe
  2⤵
  PID:9012
- C:\Windows\System\togXIoe.exe
  C:\Windows\System\togXIoe.exe
  2⤵
  PID:9512
- C:\Windows\System\LqbKKPI.exe
  C:\Windows\System\LqbKKPI.exe
  2⤵
  PID:9356
- C:\Windows\System\jErUSUl.exe
  C:\Windows\System\jErUSUl.exe
  2⤵
  PID:10856
- C:\Windows\System\eRPJpsJ.exe
  C:\Windows\System\eRPJpsJ.exe
  2⤵
  PID:8396
- C:\Windows\System\eImiqdt.exe
  C:\Windows\System\eImiqdt.exe
  2⤵
  PID:8972
- C:\Windows\System\FYOpDsg.exe
  C:\Windows\System\FYOpDsg.exe
  2⤵
  PID:10892
- C:\Windows\System\VuPOVUZ.exe
  C:\Windows\System\VuPOVUZ.exe
  2⤵
  PID:8048
- C:\Windows\System\guwxqrz.exe
  C:\Windows\System\guwxqrz.exe
  2⤵
  PID:7368
- C:\Windows\System\vjmoahD.exe
  C:\Windows\System\vjmoahD.exe
  2⤵
  PID:7552
- C:\Windows\System\qKdqXOQ.exe
  C:\Windows\System\qKdqXOQ.exe
  2⤵
  PID:10260
- C:\Windows\System\MHWjVmC.exe
  C:\Windows\System\MHWjVmC.exe
  2⤵
  PID:9420
- C:\Windows\System\clPfDHF.exe
  C:\Windows\System\clPfDHF.exe
  2⤵
  PID:10964
- C:\Windows\System\HlfwoZP.exe
  C:\Windows\System\HlfwoZP.exe
  2⤵
  PID:10376
- C:\Windows\System\pTjxwBj.exe
  C:\Windows\System\pTjxwBj.exe
  2⤵
  PID:10448
- C:\Windows\System\CfysEWp.exe
  C:\Windows\System\CfysEWp.exe
  2⤵
  PID:10512
- C:\Windows\System\UGCwKqG.exe
  C:\Windows\System\UGCwKqG.exe
  2⤵
  PID:12312
- C:\Windows\System\ZYGEcAN.exe
  C:\Windows\System\ZYGEcAN.exe
  2⤵
  PID:12328
- C:\Windows\System\zfNCOJL.exe
  C:\Windows\System\zfNCOJL.exe
  2⤵
  PID:12348
- C:\Windows\System\YaUHYxQ.exe
  C:\Windows\System\YaUHYxQ.exe
  2⤵
  PID:12364
- C:\Windows\System\IrTvhUD.exe
  C:\Windows\System\IrTvhUD.exe
  2⤵
  PID:12380
- C:\Windows\System\jDdqDVk.exe
  C:\Windows\System\jDdqDVk.exe
  2⤵
  PID:12396
- C:\Windows\System\SqEcjni.exe
  C:\Windows\System\SqEcjni.exe
  2⤵
  PID:12412
- C:\Windows\System\DEMNaWE.exe
  C:\Windows\System\DEMNaWE.exe
  2⤵
  PID:12428
- C:\Windows\System\bSdGpPn.exe
  C:\Windows\System\bSdGpPn.exe
  2⤵
  PID:12448
- C:\Windows\System\YrMPUQi.exe
  C:\Windows\System\YrMPUQi.exe
  2⤵
  PID:12464
- C:\Windows\System\FCdgMUt.exe
  C:\Windows\System\FCdgMUt.exe
  2⤵
  PID:12480
- C:\Windows\System\DXRLjPe.exe
  C:\Windows\System\DXRLjPe.exe
  2⤵
  PID:12496
- C:\Windows\System\hiLKXpn.exe
  C:\Windows\System\hiLKXpn.exe
  2⤵
  PID:12516
- C:\Windows\System\vDMOcbp.exe
  C:\Windows\System\vDMOcbp.exe
  2⤵
  PID:12540
- C:\Windows\System\ZoVakKF.exe
  C:\Windows\System\ZoVakKF.exe
  2⤵
  PID:12556
- C:\Windows\System\gUSYVlC.exe
  C:\Windows\System\gUSYVlC.exe
  2⤵
  PID:12572
- C:\Windows\System\ZdqqENR.exe
  C:\Windows\System\ZdqqENR.exe
  2⤵
  PID:12588
- C:\Windows\System\qimktnn.exe
  C:\Windows\System\qimktnn.exe
  2⤵
  PID:12616
- C:\Windows\System\GtECfri.exe
  C:\Windows\System\GtECfri.exe
  2⤵
  PID:12636
- C:\Windows\System\NULbRaH.exe
  C:\Windows\System\NULbRaH.exe
  2⤵
  PID:12668
- C:\Windows\System\wFNpbtC.exe
  C:\Windows\System\wFNpbtC.exe
  2⤵
  PID:12684
- C:\Windows\System\vaJLARq.exe
  C:\Windows\System\vaJLARq.exe
  2⤵
  PID:12700
- C:\Windows\System\gnyhdnB.exe
  C:\Windows\System\gnyhdnB.exe
  2⤵
  PID:12724
- C:\Windows\System\wdVqTlW.exe
  C:\Windows\System\wdVqTlW.exe
  2⤵
  PID:12744
- C:\Windows\System\utXoWGQ.exe
  C:\Windows\System\utXoWGQ.exe
  2⤵
  PID:12768
- C:\Windows\System\DulNokG.exe
  C:\Windows\System\DulNokG.exe
  2⤵
  PID:12796
- C:\Windows\System\BJOiYYr.exe
  C:\Windows\System\BJOiYYr.exe
  2⤵
  PID:12816
- C:\Windows\System\wKXlaCS.exe
  C:\Windows\System\wKXlaCS.exe
  2⤵
  PID:12836
- C:\Windows\System\aadWHFg.exe
  C:\Windows\System\aadWHFg.exe
  2⤵
  PID:12856
- C:\Windows\System\tsBFvQF.exe
  C:\Windows\System\tsBFvQF.exe
  2⤵
  PID:12876
- C:\Windows\System\dmEVCsp.exe
  C:\Windows\System\dmEVCsp.exe
  2⤵
  PID:12900
- C:\Windows\System\XmTEQqu.exe
  C:\Windows\System\XmTEQqu.exe
  2⤵
  PID:12928
- C:\Windows\System\JTDtcEz.exe
  C:\Windows\System\JTDtcEz.exe
  2⤵
  PID:12948
- C:\Windows\System\qDgxSax.exe
  C:\Windows\System\qDgxSax.exe
  2⤵
  PID:12972
- C:\Windows\System\WkDCPnF.exe
  C:\Windows\System\WkDCPnF.exe
  2⤵
  PID:13000
- C:\Windows\System\opAvSZo.exe
  C:\Windows\System\opAvSZo.exe
  2⤵
  PID:13020
- C:\Windows\System\hbYfepa.exe
  C:\Windows\System\hbYfepa.exe
  2⤵
  PID:13044
- C:\Windows\System\mEIYHHx.exe
  C:\Windows\System\mEIYHHx.exe
  2⤵
  PID:13064
- C:\Windows\System\kEQruga.exe
  C:\Windows\System\kEQruga.exe
  2⤵
  PID:13084
- C:\Windows\System\HszpTje.exe
  C:\Windows\System\HszpTje.exe
  2⤵
  PID:13108
- C:\Windows\System\ZGCISCx.exe
  C:\Windows\System\ZGCISCx.exe
  2⤵
  PID:13128
- C:\Windows\System\wdYnvek.exe
  C:\Windows\System\wdYnvek.exe
  2⤵
  PID:13152
- C:\Windows\System\sKwuSDh.exe
  C:\Windows\System\sKwuSDh.exe
  2⤵
  PID:13172
- C:\Windows\System\gPVTTKB.exe
  C:\Windows\System\gPVTTKB.exe
  2⤵
  PID:13192
- C:\Windows\System\dJjmWRX.exe
  C:\Windows\System\dJjmWRX.exe
  2⤵
  PID:13212
- C:\Windows\System\teIrMah.exe
  C:\Windows\System\teIrMah.exe
  2⤵
  PID:13236
- C:\Windows\System\TucopIb.exe
  C:\Windows\System\TucopIb.exe
  2⤵
  PID:13264
- C:\Windows\System\ggiJhut.exe
  C:\Windows\System\ggiJhut.exe
  2⤵
  PID:13292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kttpfqff.agr.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BuVeEBk.exe

Filesize
2.2MB

MD5
aac8cd6d2049767f263f5d8f6378db30

SHA1
e7731057010f802716e3170093cdf4d2fae1e521

SHA256
f4bfb3c1851bbce6248a95fbd43588da2ee847948d435d58a511202b068a933f

SHA512
31371a56e4d7e4974f5f1fcb50fafcd8dcc6a090244b17de50e275bf6645dd16aba7e441bc86a5e0fc7c1c8a21dad4050018fcf5cba0f45972f60ec6c5b02154

Download Submit
C:\Windows\System\Exxcllw.exe

Filesize
2.2MB

MD5
20200b042bc1df0628ae002ad1c955d3

SHA1
45a6c0b22ac051659855a69cc70bd24baa62ef9a

SHA256
3e99febaa4a0d03f6745421e5c92f6d638ef09dddee2e1dc981a67a6a4adaf47

SHA512
12053c531815a203c6e4c47aaa7e1489333d838e4c03d7c1dda24b774d318cb6a815255b88e2649ef375c539164e1378249819eb69e883fe870228bd596c30f7

Download Submit
C:\Windows\System\HwNODZK.exe

Filesize
2.2MB

MD5
804c5256b3ffeae0dcb649443caf0de8

SHA1
6308962c74dc3e9a2776e7f02040023de0e5fca8

SHA256
d0a5e5786ecba1c1194c23d26390c3c9439692250c7ef4e4ac87f81b9a9e8b2f

SHA512
27d51957dab5c1715590f39f91259d31597b66ac9042e77e0cc1cabcbf7490fee928a4421a9353d40d1c4bba7be702d45a83a5537921ef7bd1c5f54ec615e5f3

Download Submit
C:\Windows\System\JUgJgzn.exe

Filesize
2.2MB

MD5
8a42eadd84901e1e03a13f376d27cef3

SHA1
12c5206610c61e3bc5c1da88b36418a1a0fcd5c2

SHA256
a2565a17c67cc1822510baef89d0b31098845770643237b55a37e667490c53ec

SHA512
b14ad894267d952c78ef6f2fb49ce4a389eb3e2e9b43ddf920b57a74d296871be4eed9f094af94cf4a29b6096e273963f2986ed3a34938118b0e655bac4a2a15

Download Submit
C:\Windows\System\NtaupkE.exe

Filesize
2.2MB

MD5
ab4b40b884aea7bae98fe46a0c8cf4b5

SHA1
0769a8f41e01e2a2a12d3e4ff8d16d06032693a1

SHA256
755e809be57902f33c45a41ea0aadb748d3b6fc8238e7878302c2791fc08ae65

SHA512
97f53bc0b7f71274225dc4b304f7d0c589efe2779b625077759b6040f80495aa46d8dfbf621b441ed59d23cc0cba400193ece8864730896cc0f64ce1fa88c6c3

Download Submit
C:\Windows\System\NuQabKw.exe

Filesize
2.2MB

MD5
60ae35a9314fc91b23809ee3f6a1e24f

SHA1
a16bedd4c0483c3ab66a48a17fae03885398090f

SHA256
f3de2e88d684727fd8243b4cab3fee783686d965ae3ccae76e0688885cf41143

SHA512
8cb8851744dd3851c93f49e9d17f0c82169c50cc3030078e15771f228208a72c40105aa05e23b3d1851e8a21d44a454559fdc12ae06d8f138b885bb6496f99c8

Download Submit
C:\Windows\System\OSXBand.exe

Filesize
2.2MB

MD5
a5be8a5f9200261c0a7fd6fbef46c106

SHA1
1aee3e59916d2cd966f708b8ecafb8aa8bd4a2f6

SHA256
76382ceb6ec14beb362858beb743a91bdfb18826c522f938ea8485da8e54252c

SHA512
c654e9a67b463d3aa3a69710109d12a5b5abc9c5cd159d2e76dd270bd8906a4300bac03e8ef558ef7abe222ec9c76f6157526943cbc6a5bb212ce7f2a5ea7cd0

Download Submit
C:\Windows\System\PNdrLDi.exe

Filesize
2.2MB

MD5
997139a0803bf5fb1838b93de88711d0

SHA1
e9347879ad7ed820342330724fc6028d31644c7a

SHA256
39182e9a4cee2022d39e2786c890ff5d04a3be9bfa643014e6be566ec11d3ae4

SHA512
912e9bd485fd0fbb9e26d08167ee978bdfcd138ccf028df23c19f44d5d13fe8867544ff819d86bc919b1d67105e7617eb23140e8d6c925dd0dad092f8574ac1e

Download Submit
C:\Windows\System\SgwalDy.exe

Filesize
2.2MB

MD5
e5b0898a2fc32081df96d366c0f6e478

SHA1
d435b5b3ea119983251d191f07ae925cc0e363e7

SHA256
459c73c04423df4d99aebb253d10d816ae370d6f12d2bc11414b9449adadf33e

SHA512
91416fe1f157de76c00da68a651df897084dbd8afe71925d75bdfefa622f357ddf89603e082b5073fd1c3979f3c02be036ad42b75ebd07de6aa587929a16a788

Download Submit
C:\Windows\System\UsqzYeK.exe

Filesize
2.2MB

MD5
b335e372257bd52bb2b6b1e97f588a12

SHA1
42f13d5ba901ac903e19c0ebee029ef3deba51fe

SHA256
c9769193638b9db76be6f2b42e96cb9a55d58a01bbbf1e2275b69fe231e77366

SHA512
5c601da5b10f9dfcf581345104e623990724db3d6f95d88606fcdcb0cb6bd2f771d2e748598eec8b9d5abe030c7d70d26bf1fd7c43d32c77e441807015284e94

Download Submit
C:\Windows\System\WMMDXQJ.exe

Filesize
2.2MB

MD5
fbb591a9494c598fca683be4413f5680

SHA1
cbac9b45d6501c876b93f33d91499cc8f8310a42

SHA256
acc8d8fee4bebb36e84c159b4a9569ba8f5dc89fbef4657899beab5c4fd27b03

SHA512
42ed8e8eb8347117962fc2639994927694bfc214ce0e512f6a87b5a5b0007954620c542e8c7c61c1be6ece8c6e5e051704d540decebdca296ed9652f789b298a

Download Submit
C:\Windows\System\WtZyiez.exe

Filesize
2.2MB

MD5
aef2d271760f6b2a8c2d9d0dc5284519

SHA1
494180917f0483956ed3a1dd5500b2f8c8f7d9dd

SHA256
eed281be708301e3a5f3550e3f87dac2d1122b3ad0ee4598bf27b7f1a30f84fd

SHA512
288dde531805760fe8335e472856ede7243346896a141b942205393c84a3c732f1354308fb401535b2e1634dbee005313f90fb372b2fc9d727803453332c42c0

Download Submit
C:\Windows\System\XKxTeJZ.exe

Filesize
2.2MB

MD5
a6809f24ee3444d4d0181d3dc0737118

SHA1
cbd92520ce2bdcd0b12decc2bfeb01c1ec532d11

SHA256
9063b82695cc6ea3756cd8aab52ed9167795034728bf3a23255a3111da78bcad

SHA512
394a242bb3b7e9eabfee155d7e230023b9e5a8b514105cfe0b68b546277804bd54c4b8934fd28071f18b954076e9522f927ac76ec13b68e36d74c3fa645fd97a

Download Submit
C:\Windows\System\YyGXEwn.exe

Filesize
2.2MB

MD5
2dbd9a699e924d5797639f2e5efda034

SHA1
1c3ee282b8ae521207a01f386d467575c0f0518d

SHA256
d0734e8de98a065e67791be33d900f0f12233946dd490f905ec810a640e512f2

SHA512
f3509fdc258295db94d270aad6e94d6ea95b7164b80f876dccdab58cdeb4ae6972a52ce7a0f67911b3f6b3b5d71bd4f0c54b61fb99c8f29b11d6b359a9a420e9

Download Submit
C:\Windows\System\bCyzMgm.exe

Filesize
2.2MB

MD5
c0b7380d13b53c3e4ff64f9ab3e72c39

SHA1
885a1f2e4637526db38821614c7598e7b9b53eaf

SHA256
8a7b5f784f0b407338b04eda478401f70766ddba368399e6ed5092f9ae00337a

SHA512
5ac8ea142ffe108c8bc235672048b618655ed143102fa52f5a86f69c8949a732cf8362cc2c6f9f0b2bc6a32f23982bd08daf3f4402b592e7ea9583ac3ffff158

Download Submit
C:\Windows\System\bMbvRZz.exe

Filesize
2.2MB

MD5
1a33a9ce5829aa63ba1245bc31a0983a

SHA1
e8810886838ca68af4db4f2664051ed1ba157a90

SHA256
1ae2d56886cf7494837db089fbac53e5fd7679789412f68369bb68418e8a0b6f

SHA512
6c8b1caaf6803db3402812b678a8d069b14dff90f157e40f8f13fc293c6744760196854a30c44d2f1649206d2f920d997c879c5a9014d3f58d0c5fe910da1e5c

Download Submit
C:\Windows\System\ceyiJle.exe

Filesize
2.2MB

MD5
48a136e8cb679c9cd32fb18c9d4e2aff

SHA1
6ee86db84d97264701ca65b6d85ffa38f494f20b

SHA256
eafaf0e5ecd1f429d3bda5bd4aedf924f7a98ede55c31e0c958fa3dc98734961

SHA512
3386c8674b0eb83ec588d5a0c614cce3cb2f5d8f4672a4271ef2ee0316393a19cd39584caa169d5b618a60f5c179d0cebd8a5067180ff15dcc43b1ce9a3e417c

Download Submit
C:\Windows\System\enLRyFl.exe

Filesize
2.2MB

MD5
0f531e47cf2e3de6c67cf89e5e3c0be3

SHA1
b93223e65011102d1d910f7cf7d9163bc542ebfd

SHA256
61ff0be8669658952614878aab01590df641fb520113d96ff0198b0896ad9d60

SHA512
6da6e0e54fdb1d44bfbcd4507892d443c6b82d1f7bcfe3178a70d356f53ffaebf28322500b1716faba5e9b9aa9f201a5b244ea13aceb106a329a0faa37be70e7

Download Submit
C:\Windows\System\eneuXwN.exe

Filesize
2.2MB

MD5
fea9204ef93b260e6a3d679eba26b95c

SHA1
0aecf7e767001995f546655dfceaefbdd396b6fd

SHA256
45c768d0269942c8c5ffde172b034b8800ceb3e842f54234280819a16a77b5f0

SHA512
4c91170416be2e2460a77506b7f72e8fbe7b5362b49c0a5dcff5414841723ffc90922f76db54c05c64622583dece79fd2215d2a3c28b106b9df3bf8affa49160

Download Submit
C:\Windows\System\fzzmBlV.exe

Filesize
2.2MB

MD5
a1ee4d27cdd22db8fc304a51739943c0

SHA1
60fcf64a75106bf37396e79cbfa278dd9afe17d3

SHA256
d67efff90d62521fed690469aafc2bf43cefd212b265e902b4ed64ba017c613c

SHA512
b7225c3057d632cb7b54f02406351652601999b653f109c27eaff8fcdab6ca3701574391428396d91de488893470a880ad3f7314824e323a4406e480782e372b

Download Submit
C:\Windows\System\gTsEipQ.exe

Filesize
2.2MB

MD5
9cb49e3ff806a44163cdbc4431295197

SHA1
5d7f803ccf9b96ced9a0f5c0a3db2be0543b9614

SHA256
c6d6de803c3b445c5ccd7030b5723998a7393121290e23807745450c598b751c

SHA512
42a4d4876f3b8af62b9c5620fbed459a541af454a545db518263c6b502a2692a44e6443b84729db456cc2c41b61d798042bbde7175d41a4b9c587451aabf2123

Download Submit
C:\Windows\System\hqBtSug.exe

Filesize
2.2MB

MD5
4830f51a1447101df81a6caf1c9698d2

SHA1
d3a0d621701e32eebbaad2de80c52ae9df5616ed

SHA256
6837a82c1fe67a2226d71d2dafbc3f1201869f003859e0954fe7b1b7d3cee9e0

SHA512
5fcef154b01ba574b9db814881d9d6f4a4aa8abb9ff4eb7c05b18dddd382e61f8e0fa98ea4679866e2d4c430d34e85a9059f973255b0dff10262f25a42a5d740

Download Submit
C:\Windows\System\hrxulFf.exe

Filesize
2.2MB

MD5
3b0ed1f98365971ee36886ad85ae8a10

SHA1
e90178d6128590443941e3a09f00408b15dc61f2

SHA256
41b6201e98b50c117bcb98a3e34aecda1870fac20bf282729ced69db07ea6816

SHA512
d023c6ceb72ef332d1ef9cc066a485d86bad9e25c9f42f79c5b06758e89a3ee813bf76688443ee4c1412470d9b0f67be181f96c8f58995c46bc8d248bd3b5000

Download Submit
C:\Windows\System\jVHocZK.exe

Filesize
2.2MB

MD5
e6932412054dcebebddeddec19c9ef94

SHA1
a5911bb12a86adb5936122f8ac62e5782f594991

SHA256
0a9f397d5638becea78c340cd38c9f6fd3a4eef9d0054e07760ce2c5a2c4a828

SHA512
efb09a855bc0f84382e758b12975aaf33e89bcb512e50fe91ded4213e74232d2c720bd1989915964ddccacad3c11a85cfd8a7c46ac7d49dd94a34279a25866d7

Download Submit
C:\Windows\System\oHxzUuM.exe

Filesize
2.2MB

MD5
3a89eb52f3a3a7bbb07f661b657a459c

SHA1
d284aa6ca9c9f00aa81322fd15075a5495716439

SHA256
70aae749d42f537cb09d9e35080bf8c8c0d937e9f81dc48f05f2fdf673473f0d

SHA512
d9aab25e5fccf125baa4f5a17d109c31055c8d89fda25d8705fa661516f3ba9ade8d21784559a8d64809c5bf2a6aed6ca03a74bc218c5c34dc93081c48f26f5d

Download Submit
C:\Windows\System\ouFQIJg.exe

Filesize
2.2MB

MD5
d3008d3d8d8c772aaf897381597db561

SHA1
f4994f9b4c272fa7c984eebd982b6407eb8f75e3

SHA256
9868d38ccf708a685aa6d2ea16f3a68ba60ab58d4ffcd02f2354f456e83e3f3a

SHA512
6ef59bda271910eabff3f84db8674add55e315e9d6e27df5bb16e4220089cec82ce16f2d9c29806aa0b689fe7acd158b341319382f51344d4869d5a20ce18778

Download Submit
C:\Windows\System\qAXvgmv.exe

Filesize
2.2MB

MD5
ee989bdcf80c39035946c7b590a85b00

SHA1
16f0e069aecf98d7c75a22d0ab7acc554f79f0e6

SHA256
70389ae90325918cb7a7af215bdf93dc08813145b7f17a5ad52b577f14713db4

SHA512
1045e01344e19281f708ff4b6d9fdd7cabbe5b0326b12692708843eee3374c7deceeafd803a42f43ff56382c20170fe5c83c8e63425154942c537c3f29f7155a

Download Submit
C:\Windows\System\qEYLgfe.exe

Filesize
2.2MB

MD5
e11ee989f6a50b3d41ed102baee488b6

SHA1
1dcc5dd1440a2b6ec1da99c5811a96d5d1c494d7

SHA256
22a580e3c0314011f755a7fccbc6be13936f92c38be7379609882565ea587677

SHA512
9f4bee64a15e8999077461f37c1de5768322fba2dba5bdb8b2aad853ba56897c982e20b14e6d189df0926b385fe4da66f4631c371254361c9025d5115c452ef1

Download Submit
C:\Windows\System\qnaTITV.exe

Filesize
2.2MB

MD5
623e67ff4df1d84bbb0076d9dc2a12c5

SHA1
7e0a02ddee2b943d03dcd4a9e148778964c8bebe

SHA256
7a8fdf13c11551cbda2a98da7c4a9bca6ad9484934edfa934896ef53f5b2c7ea

SHA512
11aa9ce21a5f0f2ed27e9d85f897d971642a74280e132da0f990d79835e07ac0dc26a04b55f40fa08580a53aedec357eb346200b47193905c50dd0d921c5d3a8

Download Submit
C:\Windows\System\rNSFZcz.exe

Filesize
2.2MB

MD5
e3ec7d824c3b3c592eaffc644f000453

SHA1
6c3df96b4d86ea15f215007f309a41fc05ed4ded

SHA256
43cdf001f2e2360404a1d0a4816d15e1afa1d84253d1854ead18c718264ef34b

SHA512
7a1fdb8ace4c1f75534b72b1489cfe6bfa96888caeeaff249823f778b0c401d62aff64466ff422427c19bf0834f7620446aa71cfbaff42c2b83abc0c6dfed2f3

Download Submit
C:\Windows\System\rgNEllb.exe

Filesize
2.2MB

MD5
6c76c05f15db9f39c069c4dae2d3f64d

SHA1
a970ee9c5ebfba99817d0b27516ceaea942fd531

SHA256
af851cb8d3ac75c171d096ed1ab05e5a8a0605ec0329877607c3f8ad45ef3bef

SHA512
e9293dff15e72dc2c3383b24fd275fb346ee368792132f16067f449462c6948accb6c50a28178f2726d8acfa0e6050ae6985997b2e15cd9f23f80fef015a5259

Download Submit
C:\Windows\System\sCslkGV.exe

Filesize
2.2MB

MD5
2de7cc3c8f5d458ad6b87ee0a929b5d7

SHA1
fec8f630a48112fffc992f20343ce39dfe44e2d4

SHA256
e90573215c440305a4460075198c6678f8646a9f2fe907dfd6df0e137629793d

SHA512
01428c328ab31547067ce0362c4281a69a31e4372dc7e8e831f9050a91fce40c50056c935df56ac0d70030f636591edc558d37b30f09940e88ecfd3f50e83edf

Download Submit
C:\Windows\System\tzxuCca.exe

Filesize
2.2MB

MD5
30baad210564b91e155b3a36c382b8f8

SHA1
187a2df629ea7961c56766ca57b6668fd44c89a7

SHA256
3a1e40821e7765458b0581cec8272afe5fa75409294d2e76be581deb8c0072c2

SHA512
d6b521f881b06e89389ab702643d41cb07bb8a77ad2c9b1ea7d34ee07651ec3c9e933fc222654b373064a5b73f11e97164ab43a7092bffa2d2d665b3b24d8d3e

Download Submit
C:\Windows\System\wZQFlVI.exe

Filesize
2.2MB

MD5
cefca526044d61330c1a72e643b15b9c

SHA1
565b5ae08735a2d80c739318123eb1322b8c0876

SHA256
609d9ae64727163b4a2df740a04a3b1ebb6ad11c8a224cea911a40069e5024a6

SHA512
d6fb8eebaa95957443a13669aa66e6d2ef9f5110a925b82d847c31c101e729425ee9041c262ee01b23763cf54c00420792a42f7899356d5ca0246c47d8736b78

Download Submit
C:\Windows\System\wpRWDfu.exe

Filesize
2.2MB

MD5
0b58b317264b74c76f36f9f2e31c3187

SHA1
4b2b186be8a322fe1d517ddcdfe85fd0ff3fad9b

SHA256
d51acf5a9643a85c1f8a7be876e2f9e8a516eb856268550394249ec45f8b4064

SHA512
7bd315d71a7c07b0ecc5541d12b9f60cf870ad48898b5dbd618647a2c4372c7510dfc40e3d49d09abed2aea330b7ccad8dfd8985e4609f557de6f3814f25ca06

Download Submit
C:\Windows\System\xTzSVkf.exe

Filesize
2.2MB

MD5
9a37237fe315bd9d1bdf3037c9dbb5eb

SHA1
a81c3d1f712146ba494e189fb0b8a2628b5ed5ce

SHA256
6dfed2898012243f949c9b3fe1301d50ab9a6cd05b6b25dd25d8da54c98bdcd0

SHA512
529709062e847ce00948fe6b34a405089fd58c3c312b4ed9491f3018feb5366975a883ad4603a1796e306ee513063d0ef08a697c98e1f73b1b6e27c5dd3958a4

Download Submit
C:\Windows\System\zFDvAgl.exe

Filesize
2.2MB

MD5
64aa91a3608099621883da7e77c9839c

SHA1
33eed5fcd195b6b2b82c61fe6dd1dc4942abbf85

SHA256
74c55af5f8ba43275c5ebaa034d08ec6f7fc56ec8e2e0916baaebcefe15126c8

SHA512
3eb93a4cfb108e9c925a60dded1916da844e3741ecb2dbbffc37846d3a2a7207b31a254269ffaa95d75494de17bf40e7da02a6eeb9e8e5548f24f7185a1cad18

Download Submit
memory/1056-98-0x00007FF64DFB0000-0x00007FF64E3A2000-memory.dmp

Filesize
3.9MB

Download
memory/1056-2034-0x00007FF64DFB0000-0x00007FF64E3A2000-memory.dmp

Filesize
3.9MB

Download
memory/1412-261-0x00007FF7423F0000-0x00007FF7427E2000-memory.dmp

Filesize
3.9MB

Download
memory/1412-2076-0x00007FF7423F0000-0x00007FF7427E2000-memory.dmp

Filesize
3.9MB

Download
memory/1584-2055-0x00007FF6254C0000-0x00007FF6258B2000-memory.dmp

Filesize
3.9MB

Download
memory/1584-238-0x00007FF6254C0000-0x00007FF6258B2000-memory.dmp

Filesize
3.9MB

Download
memory/2080-262-0x00007FF6EA300000-0x00007FF6EA6F2000-memory.dmp

Filesize
3.9MB

Download
memory/2080-2046-0x00007FF6EA300000-0x00007FF6EA6F2000-memory.dmp

Filesize
3.9MB

Download
memory/2128-2042-0x00007FF634D30000-0x00007FF635122000-memory.dmp

Filesize
3.9MB

Download
memory/2128-290-0x00007FF634D30000-0x00007FF635122000-memory.dmp

Filesize
3.9MB

Download
memory/2752-2073-0x00007FF7AE2F0000-0x00007FF7AE6E2000-memory.dmp

Filesize
3.9MB

Download
memory/2752-289-0x00007FF7AE2F0000-0x00007FF7AE6E2000-memory.dmp

Filesize
3.9MB

Download
memory/2820-1909-0x00007FFA968B0000-0x00007FFA97371000-memory.dmp

Filesize
10.8MB

Download
memory/2820-96-0x00007FFA968B0000-0x00007FFA97371000-memory.dmp

Filesize
10.8MB

Download
memory/2820-217-0x00000266F0F10000-0x00000266F0F32000-memory.dmp

Filesize
136KB

Download
memory/2820-97-0x00000266F0D60000-0x00000266F0D70000-memory.dmp

Filesize
64KB

Download
memory/3252-291-0x00007FF60E380000-0x00007FF60E772000-memory.dmp

Filesize
3.9MB

Download
memory/3252-2040-0x00007FF60E380000-0x00007FF60E772000-memory.dmp

Filesize
3.9MB

Download
memory/3412-177-0x00007FF7F38E0000-0x00007FF7F3CD2000-memory.dmp

Filesize
3.9MB

Download
memory/3412-2039-0x00007FF7F38E0000-0x00007FF7F3CD2000-memory.dmp

Filesize
3.9MB

Download
memory/3488-2049-0x00007FF6F2530000-0x00007FF6F2922000-memory.dmp

Filesize
3.9MB

Download
memory/3488-196-0x00007FF6F2530000-0x00007FF6F2922000-memory.dmp

Filesize
3.9MB

Download
memory/3552-2060-0x00007FF6088B0000-0x00007FF608CA2000-memory.dmp

Filesize
3.9MB

Download
memory/3552-288-0x00007FF6088B0000-0x00007FF608CA2000-memory.dmp

Filesize
3.9MB

Download
memory/3568-2052-0x00007FF764D80000-0x00007FF765172000-memory.dmp

Filesize
3.9MB

Download
memory/3568-195-0x00007FF764D80000-0x00007FF765172000-memory.dmp

Filesize
3.9MB

Download
memory/3592-250-0x00007FF64C920000-0x00007FF64CD12000-memory.dmp

Filesize
3.9MB

Download
memory/3592-2044-0x00007FF64C920000-0x00007FF64CD12000-memory.dmp

Filesize
3.9MB

Download
memory/3740-283-0x00007FF62B860000-0x00007FF62BC52000-memory.dmp

Filesize
3.9MB

Download
memory/3740-2068-0x00007FF62B860000-0x00007FF62BC52000-memory.dmp

Filesize
3.9MB

Download
memory/3804-127-0x00007FF747440000-0x00007FF747832000-memory.dmp

Filesize
3.9MB

Download
memory/3804-2036-0x00007FF747440000-0x00007FF747832000-memory.dmp

Filesize
3.9MB

Download
memory/4248-2058-0x00007FF77D800000-0x00007FF77DBF2000-memory.dmp

Filesize
3.9MB

Download
memory/4248-275-0x00007FF77D800000-0x00007FF77DBF2000-memory.dmp

Filesize
3.9MB

Download
memory/4424-280-0x00007FF6C5880000-0x00007FF6C5C72000-memory.dmp

Filesize
3.9MB

Download
memory/4424-2070-0x00007FF6C5880000-0x00007FF6C5C72000-memory.dmp

Filesize
3.9MB

Download
memory/4460-22-0x00007FF71D2D0000-0x00007FF71D6C2000-memory.dmp

Filesize
3.9MB

Download
memory/4460-2032-0x00007FF71D2D0000-0x00007FF71D6C2000-memory.dmp

Filesize
3.9MB

Download
memory/4468-2066-0x00007FF6FF7A0000-0x00007FF6FFB92000-memory.dmp

Filesize
3.9MB

Download
memory/4468-205-0x00007FF6FF7A0000-0x00007FF6FFB92000-memory.dmp

Filesize
3.9MB

Download
memory/4872-1902-0x00007FF619D40000-0x00007FF61A132000-memory.dmp

Filesize
3.9MB

Download
memory/4872-0-0x00007FF619D40000-0x00007FF61A132000-memory.dmp

Filesize
3.9MB

Download
memory/4872-1-0x0000025D63990000-0x0000025D639A0000-memory.dmp

Filesize
64KB

Download
memory/4960-2072-0x00007FF7DCFA0000-0x00007FF7DD392000-memory.dmp

Filesize
3.9MB

Download
memory/4960-279-0x00007FF7DCFA0000-0x00007FF7DD392000-memory.dmp

Filesize
3.9MB

Download
memory/5060-2062-0x00007FF7C8850000-0x00007FF7C8C42000-memory.dmp

Filesize
3.9MB

Download
memory/5060-287-0x00007FF7C8850000-0x00007FF7C8C42000-memory.dmp

Filesize
3.9MB

Download
memory/5092-2064-0x00007FF6AF770000-0x00007FF6AFB62000-memory.dmp

Filesize
3.9MB

Download
memory/5092-286-0x00007FF6AF770000-0x00007FF6AFB62000-memory.dmp

Filesize
3.9MB

Download